#!/usr/bin/env bash
# Публичный snapshot на github: без prod URL, токенов и kalinamall-only путей.
set -Eeuo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
WORK="$(mktemp -d "${TMPDIR:-/tmp}/ssh-monitor-github-snapshot.XXXX")"
trap 'rm -rf "$WORK"' EXIT

REF="${1:-HEAD}"
VERSION="$(git -C "$ROOT" show "$REF":version.txt 2>/dev/null | tr -d '[:space:]' || true)"
MSG="${2:-chore: public release ${VERSION:-snapshot} (SSH Monitor, no Cursor IDE traces)}"

echo "[snapshot] export $REF -> $WORK"
git -C "$ROOT" archive --format=tar "$REF" \
  | tar -x -C "$WORK" \
  --exclude='.cursor' \
  --exclude='.env'

apply_sed() {
  local expr=$1
  if [[ "$(uname -s)" == Darwin ]]; then
    find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \
      ! -path '*/scripts/push-github-snapshot.sh' \
      -print0 | xargs -0 sed -i '' -E "$expr" 2>/dev/null || true
  else
    find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \
      ! -path '*/scripts/push-github-snapshot.sh' \
      -print0 | xargs -0 sed -i -E "$expr" 2>/dev/null || true
  fi
}

echo "[snapshot] rewrite hosts and internal URLs"
apply_sed 's#https://git\.kalinamall\.ru/PapaTramp#https://github.com/PTah#g'
apply_sed 's#git\.kalinamall\.ru/PapaTramp#github.com/PTah#g'
apply_sed 's#git\.kalinamall\.ru/papatramp#github.com/PTah#g'
apply_sed 's#sac\.kalinamall\.ru#sac.example.com#g'
apply_sed 's#remote add kalinamall#remote add origin#g'
apply_sed 's#remote set-url kalinamall#remote set-url origin#g'
apply_sed 's#local name=kalinamall#local name=origin#g'

cat >"$WORK/.gitignore" <<'EOF'
.DS_Store
CalculatorApp/
.env
.env.*
ssh-monitor.conf
ssh-monitor-*.tar.gz
rutube-download.py
.ytdl-archive.txt
EOF

cat >"$WORK/ssh-monitor.conf.example" <<'EOF'
# Example configuration — copy to /etc/ssh-monitor.conf and chmod 600.
# Never commit real tokens or passwords to git.

TELEGRAM_BOT_TOKEN="YOUR_TELEGRAM_BOT_TOKEN"
TELEGRAM_CHAT_ID="YOUR_TELEGRAM_CHAT_ID"

# At least one notification channel (telegram or email) is required.
NOTIFY_ORDER=""

# Security Alert Center (optional)
USE_SAC="off"
SAC_URL="https://sac.example.com/api/v1/events"
# SAC_API_KEY="your-ingest-api-key"

# SMTP (optional, requires python3)
MAIL_SMTP_HOST=""
MAIL_SMTP_PORT="587"
MAIL_SMTP_USER=""
MAIL_SMTP_PASSWORD=""
MAIL_FROM=""
MAIL_TO=""
MAIL_SMTP_STARTTLS="1"
MAIL_SMTP_SSL="0"

# Auto-update script default (override on your server)
# REPO_URL=https://github.com/PTah/ssh-monitor.git
EOF

if [[ -f "$WORK/README.md" ]]; then
  if [[ "$(uname -s)" == Darwin ]]; then
    sed -i '' '/^> \*\*Закрытый инстанс Gitea:\*\*/d' "$WORK/README.md"
    sed -i '' '1s/^# ssh-monitor$/# ssh-monitor\
\
Bash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram\/SMTP alerts, optional IP ban (ipset\/iptables), daily report, SAC integration.\
\
**Repository:** https:\/\/github.com\/PTah\/ssh-monitor\
\
# ssh-monitor/' "$WORK/README.md"
  else
    sed -i '/^> \*\*Закрытый инстанс Gitea:\*\*/d' "$WORK/README.md"
    sed -i '1s/^# ssh-monitor$/# ssh-monitor\n\nBash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram\/SMTP alerts, optional IP ban (ipset\/iptables), daily report, SAC integration.\n\n**Repository:** https:\/\/github.com\/PTah\/ssh-monitor\n\n# ssh-monitor/' "$WORK/README.md"
  fi

  python3 - "$WORK/README.md" <<'PY'
import pathlib
import sys

path = pathlib.Path(sys.argv[1])
text = path.read_text(encoding="utf-8")
old = "## Лицензия\n\nПроект распространяется по лицензии **MIT** — см. файл [LICENSE](LICENSE).\n"
new = """## Topics (GitHub)

`ssh`, `linux`, `telegram-bot`, `smtp`, `iptables`, `ipset`, `systemd`, `security`, `monitoring`, `openssh`

## License

MIT — see [LICENSE](LICENSE). Copyright (c) 2026 Andrey "PapaTramp" Lutsenko.

<details>
<summary><strong>English summary</strong></summary>

Single-file Bash agent parsing journalctl, notification chain, brute-force IP blocking, heartbeat, optional Prometheus textfile and Security Alert Center ingest via sac-client.sh.

</details>
"""
if old not in text:
    raise SystemExit("README footer block not found; update push-github-snapshot.sh")
path.write_text(text.replace(old, new), encoding="utf-8")
PY
fi

if [[ -f "$WORK/LICENSE" ]]; then
  if [[ "$(uname -s)" == Darwin ]]; then
    sed -i '' 's/Copyright \(c\) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE"
  else
    sed -i 's/Copyright (c) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE"
  fi
fi

echo "[snapshot] secret scan"
if grep -R -E 'AAE[a-zA-Z0-9_-]{30,}|sac_[A-Za-z0-9]{20,}|[0-9]{8,}:[A-Za-z0-9_-]{30,}' "$WORK" 2>/dev/null; then
  echo "  BLOCKED: possible secrets in snapshot tree"
  exit 1
fi

echo "[snapshot] git commit in temp repo"
cd "$WORK"
git init -q
git checkout -q -b main
git add -A
git -c user.name="Andrey Lutsenko" -c user.email="papatramp@gmail.com" commit -q -m "$MSG"

echo "[snapshot] push github main (force snapshot)"
git remote add github "$(git -C "$ROOT" remote get-url github)"
git push github main --force

echo "[snapshot] OK -> github/main @ $(git rev-parse --short HEAD)"