name: Caterium One-Time Password Loader Patch
on:
  push:
    branches: ["fix/password-security-v1774"]
permissions:
  contents: write
concurrency:
  group: caterium-password-loader-patch-v1774
  cancel-in-progress: false
jobs:
  patch:
    if: ${{ !contains(github.event.head_commit.message, '[password-loader-patch]') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: fix/password-security-v1774
          fetch-depth: 0
      - name: Patch account-security loader and PWA core
        shell: bash
        run: |
          node <<'NODE'
          const fs=require('fs');
          const replaceOnce=(src,from,to,label)=>{
            const count=src.split(from).length-1;
            if(count!==1)throw new Error(`${label}: expected one occurrence, found ${count}`);
            return src.replace(from,to);
          };
          const perfPath='public/core/performance.js';
          let perf=fs.readFileSync(perfPath,'utf8');
          const loader=`  function loadAccountSecurity(){\n    if(window.CateriumAccountSecurityV1774||document.getElementById('cateriumAccountSecurityV1774Script'))return;\n    const script=document.createElement('script');script.id='cateriumAccountSecurityV1774Script';script.src=\`core/account-security-v1774.js?v=\${RELEASE}\`;script.async=false;script.onerror=()=>console.error('[Caterium] Не загрузился модуль account-security-v1774.js');document.head.appendChild(script);\n  }\n`;
          perf=replaceOnce(perf,'  const start=()=>{',loader+'  const start=()=>{','performance loader insertion');
          perf=replaceOnce(perf,'loadOfferWorkspace();loadAuthSecurity();scan(document);','loadOfferWorkspace();loadAuthSecurity();loadAccountSecurity();scan(document);','performance startup');
          perf=replaceOnce(perf,'loadOfferWorkspace,loadAuthSecurity,disconnect:','loadOfferWorkspace,loadAuthSecurity,loadAccountSecurity,disconnect:','performance api');
          fs.writeFileSync(perfPath,perf);

          const swPath='public/service-worker.js';
          let sw=fs.readFileSync(swPath,'utf8');
          sw=replaceOnce(sw,'`./core/offer-workspace-v1769.js?v=${VERSION}`,`./legacy/bootstrap.js?v=${VERSION}`','`./core/offer-workspace-v1769.js?v=${VERSION}`,`./core/auth-security-v1774.js?v=${VERSION}`,`./core/account-security-v1774.js?v=${VERSION}`,`./legacy/bootstrap.js?v=${VERSION}`','service worker core');
          fs.writeFileSync(swPath,sw);
          NODE
      - name: Commit loader patch
        shell: bash
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add public/core/performance.js public/service-worker.js
          git commit -m "security: load account password guard [password-loader-patch]"
          git push origin HEAD:fix/password-security-v1774