#!/usr/bin/env bash
# Usage: GZ_API_TOKEN=... bash portfolio.sh NIP realization.json [photo.jpg ...]
# Requires curl >= 7.76, jq and openssl. The JSON contains real, authorized materials.
set -euo pipefail
umask 077
: "${GZ_API_TOKEN:?Set GZ_API_TOKEN in the integration environment}"
if [[ $# -lt 2 || ! $1 =~ ^[0-9]{10}$ ]]; then
    printf '%s\n' 'Usage: portfolio.sh NIP realization.json [photo.jpg ...]' >&2
    exit 2
fi
nip=$1
entry_file=$2
shift 2
[[ -f $entry_file ]] || { printf '%s\n' 'JSON file not found' >&2; exit 2; }
[[ $# -le 12 ]] || { printf '%s\n' 'Up to 12 photos per entry' >&2; exit 2; }
base="https://godny-zaufania.pl/api/v1/companies/$nip"
# Keys below stay unchanged during curl's network retries. Rerunning this script starts a NEW entry.
request_key=$(openssl rand -hex 16)
response=$(curl --fail-with-body --silent --show-error --retry 3 --retry-all-errors \
    -H "Authorization: Bearer $GZ_API_TOKEN" -H 'Content-Type: application/json' \
    -H "Idempotency-Key: $request_key" --data-binary "@$entry_file" "$base/portfolio")
entry_id=$(jq -er '.data.id' <<<"$response")
version=$(jq -er '.data.version' <<<"$response")
printf 'Private draft: %s (version %s)\n' "$entry_id" "$version" >&2
for photo_file in "$@"; do
    [[ -f $photo_file ]] || { printf 'Photo not found: %s\n' "$photo_file" >&2; exit 2; }
    printf 'Caption for %s (8–180 characters): ' "$photo_file" >&2
    read -r caption
    request_key=$(openssl rand -hex 16)
    response=$(curl --fail-with-body --silent --show-error --retry 3 --retry-all-errors \
        -H "Authorization: Bearer $GZ_API_TOKEN" -H "If-Match: \"$version\"" \
        -H "Idempotency-Key: $request_key" -F "photo=@$photo_file" \
        --form-string 'stage=after' --form-string "caption=$caption" "$base/portfolio/$entry_id/photos")
    version=$(jq -er '.data.version' <<<"$response")
done
printf '%s\n' 'Confirm you have publication rights and checked the privacy of all materials.' >&2
printf '%s' 'Type PUBLISH to publish; otherwise the draft stays private: ' >&2
read -r confirmation
if [[ $confirmation != PUBLISH ]]; then
    printf 'Draft saved: https://godny-zaufania.pl/firma/%s/portfolio/%s\n' "$nip" "$entry_id"
    exit 0
fi
request_key=$(openssl rand -hex 16)
response=$(curl --fail-with-body --silent --show-error --retry 3 --retry-all-errors \
    -H "Authorization: Bearer $GZ_API_TOKEN" -H 'Content-Type: application/json' \
    -H "If-Match: \"$version\"" -H "Idempotency-Key: $request_key" \
    --data '{"rights_confirmed":true,"privacy_confirmed":true}' "$base/portfolio/$entry_id/publish")
jq -er '.data.public_url' <<<"$response"