# Add, update, or revoke user permission on a repository

param(
    [string]$ApiToken = $env:GITEA_TOKEN,
    [string]$GiteaBaseUrl = "http://afe.git:3000",
    [string]$Owner,
    [string]$Repo,
    [string]$Username,
    [ValidateSet("read", "write", "admin", "revoke")]
    [string]$Action = "read"
)

$ErrorActionPreference = "Stop"
$ConfigPath = Join-Path (Split-Path -Parent $MyInvocation.MyCommand.Path) "..\config.local.json"
if (-not $ApiToken -and (Test-Path $ConfigPath)) {
    $cfg = Get-Content $ConfigPath -Raw | ConvertFrom-Json
    $ApiToken = $cfg.ApiToken
    if ($cfg.GiteaBaseUrl) { $GiteaBaseUrl = $cfg.GiteaBaseUrl }
}
if (-not $ApiToken) { Write-Host "Error: ApiToken required"; exit 1 }
if (-not $Owner -or -not $Repo -or -not $Username) { Write-Host "Error: Owner, Repo, Username required"; exit 1 }

$ApiBase = "$GiteaBaseUrl/api/v1"
$ReposPath = "repos/$Owner/$Repo"
$Headers = @{ "Authorization" = "token $ApiToken"; "Content-Type" = "application/json" }

if ($Action -eq "revoke") {
    try {
        Invoke-RestMethod -Uri "$ApiBase/$ReposPath/collaborators/$Username" -Headers $Headers -Method Delete
        Write-Host "Revoked $Username from $Owner/$Repo"
    } catch {
        if ($_.Exception.Response.StatusCode -eq 404) { Write-Host "User not a collaborator or repo not found" }
        else { throw }
    }
    exit 0
}

$Body = @{ permission = $Action } | ConvertTo-Json
try {
    Invoke-RestMethod -Uri "$ApiBase/$ReposPath/collaborators/$Username" -Headers $Headers -Method Put -Body $Body
    Write-Host "Set $Username to $Action on $Owner/$Repo"
} catch {
    Write-Host "FAIL: $($_.Exception.Message)"
    exit 1
}