#!/usr/bin/env bash
set -euo pipefail

preferred_home() {
  if [[ -n "${RUNNER_HOME:-}" ]]; then
    printf '%s\n' "$RUNNER_HOME"
  elif [[ -n "${FORGEJO_RUNNER_HOME:-}" ]]; then
    printf '%s\n' "$FORGEJO_RUNNER_HOME"
  elif [[ -n "${HOME:-}" ]]; then
    printf '%s\n' "$HOME"
  elif [[ -n "${FORGEJO_RUNNER_WORKDIR:-}" ]]; then
    printf '%s\n' "${FORGEJO_RUNNER_WORKDIR}/home"
  else
    printf '%s\n' "/tmp/forgejo-runner/home"
  fi
}

is_ssh_private_key() {
  local candidate="$1"
  [[ -n "$candidate" && -f "$candidate" && -s "$candidate" ]] || return 1
  chmod 600 "$candidate" 2>/dev/null || true
  ssh-keygen -y -f "$candidate" >/dev/null 2>&1
}

candidate_path() {
  local path="$1"
  if is_ssh_private_key "$path"; then
    printf '%s\n' "$path"
    return 0
  fi
  return 1
}

decode_base64() {
  local value="$1"
  local path="$2"
  if command -v base64 >/dev/null 2>&1; then
    if printf '%s' "$value" | base64 -d > "$path" 2>/dev/null; then
      return 0
    fi
    if printf '%s' "$value" | base64 -D > "$path" 2>/dev/null; then
      return 0
    fi
  fi
  return 1
}

materialize_secret() {
  local raw="$1"
  local home="$2"
  local path="${home}/.ssh/burrow_forge_ed25519"
  install -d -m 700 "${home}/.ssh"

  printf '%s\n' "$raw" > "$path"
  if candidate_path "$path"; then
    return 0
  fi

  if [[ "$raw" == *"\\n"* ]]; then
    printf '%b' "$raw" > "$path"
    if candidate_path "$path"; then
      return 0
    fi
  fi

  if decode_base64 "$raw" "$path" && candidate_path "$path"; then
    return 0
  fi

  rm -f "$path"
  echo "::warning ::Injected Forge SSH key was present but not parseable; trying file candidates" >&2
  return 1
}

resolve_key() {
  local home
  home="$(preferred_home)"

  if [[ -n "${BURROW_FORGE_SSH_KEY:-}" ]]; then
    if candidate_path "$BURROW_FORGE_SSH_KEY"; then
      return 0
    fi
    echo "::error ::BURROW_FORGE_SSH_KEY is set but is not an SSH private key: ${BURROW_FORGE_SSH_KEY}" >&2
    return 1
  fi

  if [[ -n "${AGE_FORGE_SSH_KEY:-}" ]]; then
    materialize_secret "$AGE_FORGE_SSH_KEY" "$home" && return 0
  fi

  local candidate
  while IFS= read -r candidate; do
    candidate_path "$candidate" && return 0
  done <<EOF
${AGE_IDENTITY_PATH:-}
${BURROW_RUNNER_AGE_IDENTITY_PATH:-}
${RUNNER_HOME:-}/.ssh/burrow_forge_ed25519
${FORGEJO_RUNNER_HOME:-}/.ssh/burrow_forge_ed25519
${HOME:-}/.ssh/burrow_forge_ed25519
${HOME:-}/.ssh/agent_at_burrow_net_ed25519
${HOME:-}/.ssh/burrow_forgejo_ed25519
/var/lib/forgejo-runner-agent/age_keystore
${RUNNER_HOME:-}/.ssh/age_keystore
${FORGEJO_RUNNER_HOME:-}/.ssh/age_keystore
${HOME:-}/.ssh/age_keystore
${FORGEJO_RUNNER_WORKDIR:-}/home/.ssh/age_keystore
${FORGEJO_RUNNER_WORKDIR:-}/age_keystore
/tmp/forgejo-runner/home/.ssh/age_keystore
/tmp/forgejo-runner/age_keystore
EOF

  return 1
}

if resolved="$(resolve_key)"; then
  printf 'BURROW_FORGE_SSH_KEY=%s\n' "$resolved"
  exit 0
fi

echo "::error ::Forge SSH key not found. Set BURROW_FORGE_SSH_KEY or AGE_FORGE_SSH_KEY." >&2
exit 1