#!/usr/bin/env bash
# SPDX-License-Identifier: MIT
# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
#
# extract-urls.sh — Extract all URLs from the codebase and generate allowed-urls.txt
#
# Usage:
#   extract-urls.sh [--output FILE] [--repo-root DIR] [--verbose]
#
# Output: .agents/configs/allowed-urls.txt (one hostname per line, sorted)
#
# This script is the maintenance tool for the URL allowlist. Run it when:
#   - Initialising the allowlist for the first time
#   - Adding a batch of new legitimate URLs after a large feature
#   - Auditing what external domains the codebase references
#
# The GitHub Action (url-allowlist-check.yml) uses the allowlist to block
# PRs that introduce unknown hostnames.
#
# Python implementation: .agents/scripts/extract-urls.py

set -euo pipefail

# ---------------------------------------------------------------------------
# Defaults
# ---------------------------------------------------------------------------
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="${REPO_ROOT:-$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || pwd)}"
OUTPUT_FILE="${OUTPUT_FILE:-${REPO_ROOT}/.agents/configs/allowed-urls.txt}"
VERBOSE="${VERBOSE:-false}"
PYTHON_SCRIPT="${SCRIPT_DIR}/extract-urls.py"

# ---------------------------------------------------------------------------
# Argument parsing
# ---------------------------------------------------------------------------
while [[ $# -gt 0 ]]; do
	case "$1" in
	--output)
		OUTPUT_FILE="$2"
		shift 2
		;;
	--repo-root)
		REPO_ROOT="$2"
		shift 2
		;;
	--verbose | -v)
		VERBOSE=true
		shift
		;;
	--help | -h)
		sed -n '2,20p' "$0" | sed 's/^# \?//'
		exit 0
		;;
	*)
		echo "Unknown option: $1" >&2
		exit 1
		;;
	esac
done

log() {
	if [[ "$VERBOSE" == "true" ]]; then
		echo "$*" >&2
	fi
	return 0
}

# ---------------------------------------------------------------------------
# Validate dependencies
# ---------------------------------------------------------------------------
if [[ ! -f "$PYTHON_SCRIPT" ]]; then
	echo "Python extractor not found: $PYTHON_SCRIPT" >&2
	exit 1
fi

if ! command -v python3 >/dev/null 2>&1; then
	echo "python3 is required but not installed" >&2
	exit 1
fi

# ---------------------------------------------------------------------------
# Run extraction
# ---------------------------------------------------------------------------
log "Extracting URLs from: $REPO_ROOT"
log "Output file: $OUTPUT_FILE"

VERBOSE_FLAG=""
if [[ "$VERBOSE" == "true" ]]; then
	VERBOSE_FLAG="--verbose"
fi

HOSTNAMES=$(python3 "$PYTHON_SCRIPT" --repo-root "$REPO_ROOT" ${VERBOSE_FLAG:+"$VERBOSE_FLAG"})

# ---------------------------------------------------------------------------
# Write output
# ---------------------------------------------------------------------------
OUTPUT_DIR="$(dirname "$OUTPUT_FILE")"
if [[ ! -d "$OUTPUT_DIR" ]]; then
	echo "Output directory does not exist: $OUTPUT_DIR" >&2
	exit 1
fi

{
	echo "# URL Allowlist — auto-generated by extract-urls.sh"
	echo "# One hostname per line. Add new entries here to allow them in PRs."
	echo "# Regenerate baseline: .agents/scripts/extract-urls.sh"
	echo "# Approve a single URL: aidevops approve url <hostname>"
	echo "# Last generated: $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
	echo "#"
	echo "$HOSTNAMES"
} >"$OUTPUT_FILE"

COUNT=$(grep -c '^[^#]' "$OUTPUT_FILE" || true)
echo "Wrote $COUNT hostnames to $OUTPUT_FILE"
