#!/usr/bin/env bash
# agent-profile.sh — switch agent identity context.
#
# Source this script to become a specific agent. Sets git author/committer
# identity, registers a tea login (from Bitwarden), and exports the agent
# name for other tools (bw-run.sh, clone-as.sh, etc.).
#
# Usage:
#   . agent-profile.sh vp-techops
#   . agent-profile.sh vp-secops
#   . agent-profile.sh reachableceo    (back to Charles's identity)
#
# Prerequisites:
#   - Bitwarden session active (BW_SESSION exported) OR BW_CLIENTID/
#     BW_CLIENTSECRET in ~/.config/bw/env
#   - Agent credentials provisioned in Bitwarden (see agent-identity-bootstrap.md)

# Do NOT set -euo pipefail — this script is sourced, and the caller controls
# their own shell options. We guard each operation explicitly.

AGENT_PROFILE_NAME="${1:-}"

if [ -z "$AGENT_PROFILE_NAME" ]; then
    echo "Usage: . agent-profile.sh <agent-name>" >&2
    echo "  e.g. . agent-profile.sh vp-techops" >&2
    echo "       . agent-profile.sh reachableceo" >&2
    # shellcheck disable=SC2317  # reachable when executed (not sourced)
    return 1 2>/dev/null || exit 1
fi

# ---------------------------------------------------------------------------
# Display name mapping (for git author name)
# ---------------------------------------------------------------------------

case "$AGENT_PROFILE_NAME" in
    vp-techops)          _display="VP TechOps" ;;
    vp-secops)           _display="VP SecOps" ;;
    vp-techcompliance)   _display="VP TechCompliance" ;;
    coo)                 _display="Chief Operating Officer" ;;
    svp-knel)            _display="SVP KNEL" ;;
    svp-tctc)            _display="SVP TCTC" ;;
    reachableceo)        _display="Charles N Wyble" ;;
    *)
        _display="$AGENT_PROFILE_NAME"
        ;;
esac

# Domain mapping
_domain="turnsys.com"
if [ "$AGENT_PROFILE_NAME" = "reachableceo" ]; then
    _email="reachableceo@turnsys.com"
else
    _email="${AGENT_PROFILE_NAME}@${_domain}"
fi

# ---------------------------------------------------------------------------
# Export agent identity environment variables
# ---------------------------------------------------------------------------

export AGENT_NAME="$AGENT_PROFILE_NAME"
export AGENT_DISPLAY="$_display"
export AGENT_EMAIL="$_email"
export GIT_AUTHOR_NAME="$_display"
export GIT_COMMITTER_NAME="$_display"
export GIT_AUTHOR_EMAIL="$_email"
export GIT_COMMITTER_EMAIL="$_email"

# ---------------------------------------------------------------------------
# Ensure Bitwarden session is active
# ---------------------------------------------------------------------------

_bw_session_setup() {
    if [ -n "${BW_SESSION:-}" ]; then
        return 0
    fi

    local bw_env="${HOME}/.config/bw/env"
    if [ -f "$bw_env" ]; then
        # shellcheck disable=SC1090
        . "$bw_env"
    fi

    if [ -n "${BW_CLIENTID:-}" ] && [ -n "${BW_CLIENTSECRET:-}" ]; then
        bw login --apikey >/dev/null 2>&1 || true
        BW_SESSION=$(BW_PASSWORD="${BW_PASSWORD:-}" bw unlock --raw 2>/dev/null || true)
        if [ -n "$BW_SESSION" ]; then
            export BW_SESSION
            return 0
        fi
    fi

    echo "agent-profile: WARNING — no BW session, tea login will not be configured" >&2
    return 1
}

# ---------------------------------------------------------------------------
# Register tea login for this agent (if credentials exist in BW)
# ---------------------------------------------------------------------------

_tea_setup() {
    # Only set up tea for agents that have Gitea credentials in BW
    local token
    token=$(bw get password "${AGENT_NAME} Gitea" 2>/dev/null || echo "")
    if [ -z "$token" ]; then
        # Not an error — some agents may not have Gitea access yet
        return 0
    fi

    # Check if login already exists
    if tea login list --output csv 2>/dev/null | grep -q "^${AGENT_NAME},"; then
        # Already registered — just set as default
        tea login default "$AGENT_NAME" >/dev/null 2>&1 || true
        return 0
    fi

    # Register the login
    tea login add \
        --name "$AGENT_NAME" \
        --url "https://git.knownelement.com" \
        --token "$token" \
        --ssh-host "git.knownelement.com" \
        >/dev/null 2>&1 || true

    tea login default "$AGENT_NAME" >/dev/null 2>&1 || true
}

if _bw_session_setup; then
    _tea_setup
fi

# Clean up helper functions from the environment
unset -f _bw_session_setup _tea_setup 2>/dev/null || true
unset _display _email _domain 2>/dev/null || true

echo "agent-profile: now operating as ${AGENT_PROFILE_NAME} (${AGENT_DISPLAY})" >&2