#!/usr/bin/env bash
#
# Reverse every side effect `just login` produced.  Safe to re-run.

set -euo pipefail

here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
# shellcheck disable=SC1091
. "$here/common.sh"

load_env

# 1. Log out at the OAuth layer (clears our managed fields from
#    client-auth.json and keeps any fields owned by the orchestrator
#    gateway untouched).
if [ -f "$here/forge_auth.py" ]; then
    python3 "$here/forge_auth.py" logout || true
fi

# 2. Remove git credential helper + git config entries scoped to the
#    Gitea URL.
if [ -n "${FORGE_GITEA_URL:-}" ]; then
    for k in helper username useHttpPath; do
        git config --global --unset-all "credential.${FORGE_GITEA_URL}.$k" 2>/dev/null || true
    done
    git config --global --remove-section "credential.${FORGE_GITEA_URL}" 2>/dev/null || true
    info "cleared git credential.${FORGE_GITEA_URL}.*"
fi

# 3. Remove installed artefacts.
for f in "$CRED_HELPER" "$LOCAL_BIN/forge_auth.py"; do
    if [ -e "$f" ]; then
        rm -f "$f"
        info "removed $f"
    fi
done

info 'uninstall complete.'
info "note: $FORGE_AUTH_FILE is left in place if the orchestrator wrote it;"
info '      delete it manually if you want a completely clean state.'