#!/bin/sh
# Usage:
#   ./build.sh            build the image, asking for the password that unlocks the token
#   ./build.sh --encrypt  encrypt a token and print the value to paste into ENCRYPTED_TOKEN

set -eu

IMAGE_NAME="${IMAGE_NAME:-debian13-source-stack}"
PREFIX="${PREFIX:-/usr/local}"
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

# CLAUDE_CODE_OAUTH_TOKEN encrypted with AES-256-CBC (PBKDF2, base64). Generate with --encrypt.
ENCRYPTED_TOKEN='U2FsdGVkX1/BCTASs0tR40hsT+sngp46zANCbGZnklLN1M0wSJs/DxbQ6JDg593G09A+cVtVius4hJHRzB6caOO2KwBV0/+i7yUjr/PfreZksrdkz1DnFc7oorxXfvB7azuNEkQfAE2fZg8cnYL5jy3/LKRdAm11SUm83fU8ke8='

OPENSSL_ARGS="enc -aes-256-cbc -pbkdf2 -iter 600000 -a -A"

if ! command -v openssl >/dev/null 2>&1; then
    echo "Error: OpenSSL is required." >&2
    exit 1
fi

# read_secret PROMPT VARNAME: read the input with echo on, so it stays visible while typing.
read_secret() {
    printf '%s' "$1" >&2
    IFS= read -r "$2"
}

if [ "${1:-}" = "--encrypt" ]; then
    read_secret "OAuth token: " token
    read_secret "Password: " BUILD_PASSWORD
    export BUILD_PASSWORD
    printf '%s' "$token" | openssl $OPENSSL_ARGS -pass env:BUILD_PASSWORD
    echo
    exit 0
fi
SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"

if ! command -v podman >/dev/null 2>&1; then
    echo "Error: Podman is required." >&2
    exit 1
fi

if [ -z "$ENCRYPTED_TOKEN" ]; then
    echo "Error: ENCRYPTED_TOKEN is empty; run './build.sh --encrypt' and paste the output into build.sh." >&2
    exit 1
fi

read_secret "Password for CLAUDE_CODE_OAUTH_TOKEN: " BUILD_PASSWORD
export BUILD_PASSWORD
if ! CLAUDE_CODE_OAUTH_TOKEN=$(printf '%s' "$ENCRYPTED_TOKEN" | openssl $OPENSSL_ARGS -d -pass env:BUILD_PASSWORD 2>/dev/null); then
    echo "Error: wrong password or corrupted token." >&2
    exit 1
fi
unset BUILD_PASSWORD

printf 'ws2tcp-local username: ' >&2
IFS= read -r WS2TCP_USER
read_secret "ws2tcp-local password: " WS2TCP_PASS
WS2TCP_LOCAL_BASIC_AUTH="$WS2TCP_USER:$WS2TCP_PASS"
unset WS2TCP_USER WS2TCP_PASS
export WS2TCP_LOCAL_BASIC_AUTH
# Exported so podman reads the value from the environment and it never appears in the command line.
export CLAUDE_CODE_OAUTH_TOKEN

SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"

# macOS reports arm64 where Linux (and Debian multiarch) call it aarch64.
ARCH=$(uname -m)
[ "$ARCH" = arm64 ] && ARCH=aarch64

echo "Building image $IMAGE_NAME with podman (prefix $PREFIX) ..."
exec podman build \
    --build-arg CLAUDE_CODE_OAUTH_TOKEN \
    --build-arg WS2TCP_LOCAL_BASIC_AUTH \
    --build-context sources="$SOURCES_DIR" \
    --build-arg PREFIX="$PREFIX" --build-arg MULTIARCH="$ARCH-linux-gnu" \
    --tag "$IMAGE_NAME" "$SCRIPT_DIR"