#!/usr/bin/env sh
# git/install.sh — configure git identity + HTTPS credential storage.
# Idempotent: safe to re-run.
set -eu

say() { printf '%s\n' "$*" >&2; }

GIT_NAME="Nic O'Connor"
GIT_EMAIL="nic.oconnor@gmail.com"

git config --global user.name "$GIT_NAME"
git config --global user.email "$GIT_EMAIL"
say "git identity: $GIT_NAME <$GIT_EMAIL>"

# Auto-prune stale remote-tracking refs on every fetch/pull.
#
# Without this, `git branch -r` keeps listing branches that were deleted on the
# server, and zsh's git completion happily offers them — so you tab-complete a
# branch name into `git push origin --delete` and get "remote ref does not
# exist" for something that was already gone. The prefix makes it worse: the
# completion offers `origin/foo`, but the ref on the server is just `foo`, so
# even a live branch fails unless you strip it by hand. See the `gbd` helper in
# zsh/zshrc (the grmb helper) for that half.
git config --global fetch.prune true
say "fetch.prune = true (stale remote-tracking refs cleaned on every fetch)"

# Plaintext credential cache in $HOME (survives container/VM rebuilds that
# wipe everything outside $HOME). Git creates ~/.git-credentials with 0600
# the first time a credential is saved.
git config --global credential.helper store
say "credential.helper = store (~/.git-credentials, created on first auth)"

# Our own Gitea authenticates from $GITEA_KEY (exported by secrets/ from the
# vault), not from ~/.git-credentials.
#
# WHY: git never reads GITEA_KEY by itself. With only `store`, the token was
# whatever got typed at the first prompt, copied into ~/.git-credentials, and
# it silently went stale when the vault's key was rotated — or, on a box that
# never pushed, there was no credential at all and the push just failed. Now
# `opc GITEA_KEY` is the only step when the token changes.
#
# The empty helper first clears the inherited `store` for this host, so a
# rejected token is never cached and a stale cached one can never win. Gitea
# accepts the token as the password; the username is informational (GITEA_USER
# overrides it). With GITEA_KEY unset the helper prints nothing and git falls
# back to prompting, as before.
GITEA_URL="https://git.nic-oconnor.com"
git config --global --unset-all "credential.$GITEA_URL.helper" 2>/dev/null || true
git config --global --add "credential.$GITEA_URL.helper" ''
git config --global --add "credential.$GITEA_URL.helper" \
  '!f() { test "$1" = get && test -n "${GITEA_KEY:-}" && printf "username=%s\npassword=%s\n" "${GITEA_USER:-$(id -un)}" "$GITEA_KEY"; }; f'
say "credential helper for $GITEA_URL = \$GITEA_KEY (from secrets.env)"

say "Done. $GITEA_URL uses \$GITEA_KEY; other HTTPS hosts prompt once and cache in ~/.git-credentials."