#!/usr/bin/env bash
# scripts/pull-images.sh — login + pull the target image. Idempotent.

set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
. "$SCRIPT_DIR/_lib.sh"

usage() {
    cat <<'EOF'
Usage: ./scripts/pull-images.sh [--help]

Reads from the environment (use scripts/deploy.sh which sources the overlays):
  REGISTRY_HOST, REGISTRY_IMAGE, REGISTRY_TAG    image coordinates
  REGISTRY_USER, REGISTRY_TOKEN                  optional; if both set, docker login first
EOF
}

[[ "${1:-}" == "--help" || "${1:-}" == "-h" ]] && { usage; exit 0; }

require_env REGISTRY_HOST REGISTRY_IMAGE REGISTRY_TAG
require_cmd docker

IMAGE="$REGISTRY_HOST/$REGISTRY_IMAGE:$REGISTRY_TAG"

if [[ -n "${REGISTRY_USER:-}" && -n "${REGISTRY_TOKEN:-}" ]]; then
    log_info "Logging in to $REGISTRY_HOST as $REGISTRY_USER"
    echo "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USER" --password-stdin >/dev/null
else
    log_warn "No REGISTRY_USER / REGISTRY_TOKEN — assuming pre-authenticated docker"
fi

log_info "Pulling $IMAGE"
docker pull "$IMAGE"

# Surface the digest for the deploy log; the operator can reference it later.
DIGEST="$(docker image inspect "$IMAGE" --format '{{ index .RepoDigests 0 }}' 2>/dev/null || true)"
if [[ -n "$DIGEST" ]]; then
    log_info "Pulled digest: $DIGEST"
else
    log_warn "Could not resolve digest for $IMAGE (image may not have a registry digest yet)"
fi