#!/usr/bin/env bash
set -euo pipefail

# =============================================================================
# phase7_teardown.sh — Remove branch protection rules from all repos
# Deletes the PROTECTED_BRANCH protection rule via API.
# Safe to run if protection rules have already been removed.
# =============================================================================

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
source "${SCRIPT_DIR}/lib/common.sh"

# Parse arguments
AUTO_YES=false
for arg in "$@"; do
  case "$arg" in
    --yes|-y) AUTO_YES=true ;;
    --help|-h)
      cat <<EOF
Usage: $(basename "$0") [options]

Options:
  --yes, -y    Skip all confirmation prompts
  --help, -h   Show this help
EOF
      exit 0
      ;;
    *)
      log_error "Unknown argument: $arg"
      exit 1
      ;;
  esac
done

confirm_action() {
  local prompt="$1"
  if [[ "$AUTO_YES" == "true" ]]; then
    log_info "Auto-confirmed (--yes): ${prompt}"
    return 0
  fi
  printf '%s' "$prompt"
  read -r confirm
  [[ "$confirm" =~ ^[Yy]$ ]]
}

load_env
require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
             REPO_NAMES PROTECTED_BRANCH

log_warn "=== Phase 7 Teardown: Branch Protection ==="

read -ra REPOS <<< "$REPO_NAMES"

if ! confirm_action "$(printf 'This will remove branch protection for \"%s\" on all repos. Continue? [y/N] ' "$PROTECTED_BRANCH")"; then
  log_info "Teardown cancelled"
  exit 0
fi

for repo in "${REPOS[@]}"; do
  if gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" >/dev/null 2>&1; then
    gitea_api DELETE "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" >/dev/null 2>&1 || true
    log_success "Removed branch protection from ${repo}"
  else
    log_info "No branch protection on ${repo} — already clean"
  fi
done

log_success "Phase 7 teardown complete"