#!/usr/bin/env bash
# Phase 6: write important school events to Sam's Home Assistant calendar and
# read the calendar back (AGENTS.md §4 FR-8, §11 Phase 6).
#
# The school stays read-only. The only write is to the calendar. The Home
# Assistant token comes from the environment or from the service env file and is
# never printed.
#
# Usage:
#   scripts/calendar-push.sh entities
#   scripts/calendar-push.sh status
#   scripts/calendar-push.sh push [--child Harry] [--dry-run]
#   scripts/calendar-push.sh events [--days 14]
#
# Environment overrides:
#   IMAGE                image tag                  (default 0.5.0-phase7)
#   VOLUME               SQLite volume             (default compass-teams-nhs_compass-teams-nhs-data)
#   ENV_FILE             HA config source           (default environment.d/school-service.env)
#   SCHOOL_TIMEZONE      family timezone            (default Australia/Sydney)
#   SCHOOL_HA_URL        Home Assistant base URL   (no default; required)
#   SCHOOL_HA_TOKEN      long-lived access token    (no default; required)
#   SCHOOL_HA_CALENDAR_ENTITY  calendar entity id   (no default; required)
#   TIMEOUT              docker command timeout     (default 300)
set -euo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

IMAGE="${IMAGE:-compass-teams-nhs/school:0.5.0-phase7}"
VOLUME="${VOLUME:-compass-teams-nhs_compass-teams-nhs-data}"
ENV_FILE="${ENV_FILE:-$REPO_ROOT/environment.d/school-service.env}"
SCHOOL_TIMEZONE="${SCHOOL_TIMEZONE:-Australia/Sydney}"
TIMEOUT="${TIMEOUT:-300}"

# The real service env file is gitignored. Take only the calendar variables from
# it, so the service's bcrypt hash (which contains "$$") is never re-expanded.
if [[ -f "$ENV_FILE" ]]; then
  while IFS= read -r line; do
    case "$line" in
      SCHOOL_HA_URL=*|SCHOOL_HA_TOKEN=*|SCHOOL_HA_CALENDAR_ENTITY=*|SCHOOL_HA_INSECURE=*|SCHOOL_HA_TIMEOUT=*)
        key="${line%%=*}"
        val="${line#*=}"
        if [[ -z "${!key:-}" ]]; then
          export "$key=$val"
        fi
        ;;
    esac
  done < "$ENV_FILE"
fi

if [[ $# -eq 0 ]]; then
  echo "usage: scripts/calendar-push.sh entities|status|push|events [options]" >&2
  exit 2
fi

exec timeout "$TIMEOUT" docker run --rm --network host \
  -v "$VOLUME:/data" \
  -e SCHOOL_DB_PATH=/data/school.db \
  -e SCHOOL_TIMEZONE="$SCHOOL_TIMEZONE" \
  -e SCHOOL_HA_URL -e SCHOOL_HA_TOKEN -e SCHOOL_HA_CALENDAR_ENTITY \
  -e SCHOOL_HA_INSECURE -e SCHOOL_HA_TIMEOUT \
  "$IMAGE" calendar "$@"