#!/usr/bin/env bash

set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"

BASELINE_TAG="${OPENRGB_BASELINE_TAG:-upstream-openrgb-1.0rc3}"
UPSTREAM_REMOTE="${OPENRGB_UPSTREAM_REMOTE:-upstream}"
PUBLIC_BASELINE_TAG="public-release-baseline"

if [ "${OPENRGB_FETCH_UPSTREAM:-0}" = "1" ]; then
    echo "[INFO] Fetch upstream remote '$UPSTREAM_REMOTE'..."
    git fetch "$UPSTREAM_REMOTE" --tags --prune
fi

if ! git rev-parse --verify --quiet "${BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
    if git rev-parse --verify --quiet "${PUBLIC_BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
        BASELINE_TAG="$PUBLIC_BASELINE_TAG"
        echo "[INFO] Publieke releasebaseline wordt gebruikt."
    else
        echo "[ERROR] Geen upstream- of publieke baseline-tag gevonden."
        exit 1
    fi
fi

if [ "$BASELINE_TAG" != "$PUBLIC_BASELINE_TAG" ] && ! git remote | grep -Fxq "$UPSTREAM_REMOTE"; then
    echo "[ERROR] Remote '${UPSTREAM_REMOTE}' ontbreekt. Voeg upstream eerst toe of zet OPENRGB_UPSTREAM_REMOTE."
    exit 1
fi

mapfile -t CHANGED_FILES < <(git diff --name-only "${BASELINE_TAG}..HEAD")

if [ ${#CHANGED_FILES[@]} -eq 0 ]; then
    echo "[INFO] Geen verschillen t.o.v. baseline '${BASELINE_TAG}'."
    exit 0
fi

declare -a UNEXPECTED_FILES=()

for file in "${CHANGED_FILES[@]}"; do
    allowed=0
    case "$file" in
        .dockerignore|.env.example|.gitleaks.toml|.gitignore|Dockerfile|README.md|SECURITY.md|docker-compose*.yml|docker-compose*.yaml|startup/main_FreeBSD_Linux_MacOS.cpp|ResourceManager.cpp|ResourceManager.h|.github/*|.gitea/*)
            allowed=1
            ;;
        docs/*|lumaops/*|docker/*|scripts/*)
            allowed=1
            ;;
    esac

    if [ "$allowed" -eq 0 ]; then
        UNEXPECTED_FILES+=("$file")
    fi
done

if [ ${#UNEXPECTED_FILES[@]} -gt 0 ]; then
    echo "[ERROR] Verandering gevonden buiten de beoogde fork-patchset:"
    for file in "${UNEXPECTED_FILES[@]}"; do
        echo "  - $file"
    done
    echo "[HINT] Voeg tijdelijke kernaanpassingen alleen toe met expliciete uitzonderingen in deze script/handleiding."
    exit 1
fi

echo "[OK] Alleen geautoriseerde wijzigingen t.o.v. baseline '${BASELINE_TAG}'."
echo "[OK] Upstream-patchgrens blijft schoon."