#!/usr/bin/env bash
set -euo pipefail

NAMESPACE="${KAIJU_HF_NAMESPACE:-RMDWLLC}"
PROBE_REPO="${KAIJU_HF_PERMISSION_PROBE_REPO:-${NAMESPACE}/kaiju-coder-7-permission-probe}"
APPLY="${KAIJU_HF_PERMISSION_PROBE_APPLY:-0}"

usage() {
  cat <<'USAGE'
Check Hugging Face CLI auth and, optionally, model repo create permission.

Dry-run by default. Set KAIJU_HF_PERMISSION_PROBE_APPLY=1 to create a private
permission probe repo. The probe does not upload files and does not delete the
repo automatically.

After a successful apply-mode probe, record only sanitized facts in
release/hf-release-permission-evidence.json and validate them with:

  python3 scripts/collect_hf_release_permission_evidence.py --apply --write
  python3 scripts/check_hf_release_permission_evidence.py

Environment:
  KAIJU_HF_NAMESPACE                  namespace to check, default RMDWLLC
  KAIJU_HF_PERMISSION_PROBE_REPO      probe repo id
  KAIJU_HF_PERMISSION_PROBE_APPLY     0 dry-run, 1 create private probe repo
USAGE
}

if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
  usage
  exit 0
fi

if ! command -v hf >/dev/null 2>&1; then
  echo "Missing Hugging Face CLI: hf" >&2
  echo "Install: curl -LsSf https://hf.co/cli/install.sh | bash -s" >&2
  exit 2
fi

echo "hf version:"
hf version
echo
echo "hf auth whoami:"
hf auth whoami
echo
echo "hf auth list:"
hf auth list
echo
echo "Namespace: ${NAMESPACE}"
echo "Probe repo: ${PROBE_REPO}"

if [[ "${APPLY}" != "1" ]]; then
  echo
  echo "Dry run. Set KAIJU_HF_PERMISSION_PROBE_APPLY=1 to test repo creation:"
  echo "hf repos create ${PROBE_REPO} --type model --private --exist-ok"
  exit 0
fi

echo
echo "+ hf repos create ${PROBE_REPO} --type model --private --exist-ok"
hf repos create "${PROBE_REPO}" --type model --private --exist-ok
echo "Hugging Face repo-create permission probe passed for ${PROBE_REPO}."
echo "Next: python3 scripts/collect_hf_release_permission_evidence.py --namespace ${NAMESPACE} --apply --write"
echo "Then run: python3 scripts/check_hf_release_permission_evidence.py"