#!/bin/bash
set -euo pipefail

REPO_URL="https://github.com/sanu/eng-bootstrap.git"
CHECKOUT="$HOME/src/eng-bootstrap"
MDM_ENROLL_URL="https://sanu.jamfcloud.com/enroll"

# 1. MDM enrollment check
if ! profiles status -type enrollment 2>/dev/null | grep -q "MDM enrollment: Yes"; then
  echo "This Mac is not enrolled in MDM. Opening the enrollment page..."
  open "$MDM_ENROLL_URL"
  read -rp "Approve the profile in System Settings → Privacy & Security → Profiles, then press Enter. "
fi

# 2. Command Line Tools (provides git)
if ! xcode-select -p >/dev/null 2>&1; then
  xcode-select --install || true
  echo "Waiting for Command Line Tools to finish installing..."
  until xcode-select -p >/dev/null 2>&1; do sleep 10; done
fi

# 3. mise
[ -x "$HOME/.local/bin/mise" ] || curl -fsSL https://mise.run | sh
export PATH="$HOME/.local/bin:/opt/homebrew/bin:$PATH"

# 4. GitHub auth (gh runs temporarily, nothing installed yet)
mise x gh@latest -- gh auth status >/dev/null 2>&1 \
  || mise x gh@latest -- gh auth login --web --git-protocol https
mise x gh@latest -- gh auth setup-git 
GITHUB_TOKEN="$(mise x gh@latest -- gh auth token)" # avoids GitHub API rate limits
export GITHUB_TOKEN

# 5. Ask for the password once and keep sudo alive for pkg installers
sudo -v
while true; do sudo -n true; sleep 50; kill -0 "$$" || exit; done 2>/dev/null &

# 6. Apply everything
mise bootstrap --from "$REPO_URL" --from-dir "$CHECKOUT" --yes

echo "Done. Open a new terminal. Remaining manual steps: aws configure sso, infisical login."