#!/usr/bin/env bash
# Forgejo/GitHub push webhook target — validates HMAC and redeploys main.
#
# Install on CT 116 with almquist/webhook or Caddy reverse_proxy to this script.
# Forgejo → Repository → Webhooks → POST → http://192.168.68.116:9000/hooks/deploy
#
# Env:
#   DEPLOY_WEBHOOK_SECRET — shared secret (same as Forgejo webhook secret)
#   APP_DIR=/opt/submatter
set -euo pipefail

APP_DIR="${APP_DIR:-/opt/submatter}"
SECRET="${DEPLOY_WEBHOOK_SECRET:-}"

read -r payload || payload=""
if [[ -z "$payload" ]]; then
  payload="$(cat)"
fi
signature="${HTTP_X_HUB_SIGNATURE_256:-${HTTP_X_FORGEJO_SIGNATURE:-}}"

if [[ -n "$SECRET" ]]; then
  if [[ -z "$signature" ]]; then
    echo "missing signature" >&2
    exit 403
  fi
  sig="${signature#sha256=}"
  expected="$(printf '%s' "$payload" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')"
  if [[ "$sig" != "$expected" ]]; then
    echo "invalid signature" >&2
    exit 403
  fi
fi

ref="$(printf '%s' "$payload" | sed -n 's/.*"ref":"\([^"]*\)".*/\1/p')"
if [[ "$ref" != "refs/heads/main" ]]; then
  echo "ignored ref=${ref}"
  exit 0
fi

echo "[deploy-webhook] push to main — deploying"
cd "$APP_DIR"
bash scripts/git-sync-deploy.sh
exec bash scripts/deploy-prod.sh build