# Git settings for the host processes that hand nix a forge URL: hive-c0re
# (prebuilds as `hive-core`) and hive-priv (builds as root, with a HOME of its
# own), each through its own `$HOME/.gitconfig`. nix runs `git` for a `git+…`
# input, so git's config is the only credential and URL plumbing it has.
#
# - `credential`: the forge host answers through `git-credential-hive-forge`,
#   which reads the hive's own forge account and token from the file hive-c0re
#   publishes. An empty `helper =` first resets the list, so no /etc/gitconfig
#   helper (e.g. `oauth`, which waits on a browser) runs ahead of ours.
# - `url`: the swarm's `internal/meta` lock names its inputs by the forge's
#   `https` URL, which only the builder's credential helper answers for. They
#   are fetched over the `http` URL the helper above is scoped to.
#
# Pure function — NOT a NixOS module (don't add it to the host-modules
# aggregator). Call it from a module's `let`:
#
#   forgeGit = import ./lib/hive-forge-git.nix { inherit pkgs; forgeDomain = …; };
#   # then put `forgeGit.credentialHelper` on the unit's `path` and
#   # `forgeGit.config` into its gitconfig.
{ pkgs, forgeDomain }:
{
  # Answers only `get`. The file (`/run/hyperhive/forge-hive-token`, hive-c0re's
  # `paths::FORGE_HIVE_TOKEN`) holds the account on its first line and the
  # token on its second; it is read on every invocation, so it never holds a
  # stale copy and survives token rotation. Prints nothing where the file is
  # absent or incomplete.
  credentialHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
    [ "''${1:-}" = "get" ] || exit 0
    [ -r /run/hyperhive/forge-hive-token ] || exit 0
    { read -r login; read -r token; } < /run/hyperhive/forge-hive-token || true
    [ -n "$login" ] && [ -n "$token" ] || exit 0
    printf 'username=%s\n' "$login"
    printf 'password=%s\n' "$token"
  '';

  config = ''
    [credential]
    helper =
    [credential "http://${forgeDomain}"]
    helper =
    helper = hive-forge
    [url "http://${forgeDomain}/"]
    insteadOf = https://${forgeDomain}/
  '';
}