#!/usr/bin/env bash
set -euo pipefail

ORG="${ORG:-trade-next}"
SECRET_NAME="${SECRET_NAME:-SOL_SSH_PRIVATE_KEY_B64}"
GITEA_URL="${GITEA_URL:-https://gitea.mpabi.pl}"
GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-/home/user/dev/mcp/tools/tokens/gitea.token}"
SOL_SSH_KEY="${SOL_SSH_KEY:-/home/user/dev/mcp/keys/mpabi/mevnode_mcp}"

gitea_token() {
  cut -d: -f2- "$GITEA_TOKEN_FILE" | head -n1 | tr -d '[:space:]'
}

API_TOKEN="$(gitea_token)"
if [ -z "$API_TOKEN" ]; then
  echo "Gitea API token is empty" >&2
  exit 1
fi

if [ ! -f "$SOL_SSH_KEY" ]; then
  echo "Missing SSH key: $SOL_SSH_KEY" >&2
  exit 1
fi

KEY_B64="$(base64 -w0 "$SOL_SSH_KEY")"
PAYLOAD="$(jq -nc --arg data "$KEY_B64" --arg description "base64-encoded SSH key for sol host automation" '{data:$data,description:$description}')"

curl -fsS \
  -X PUT \
  -H "Authorization: token ${API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" \
  "${GITEA_URL}/api/v1/orgs/${ORG}/actions/secrets/${SECRET_NAME}" \
  >/dev/null

echo "Organization secret ${ORG}/${SECRET_NAME} updated"