param(
    [string]$EnvFile = (Join-Path $PSScriptRoot '.env'),
    [string]$Profile
)

$ErrorActionPreference = 'Stop'

function Get-EnvValue([string]$Path, [string]$Name) {
    if (-not (Test-Path -LiteralPath $Path)) {
        return $null
    }

    $line = Get-Content -LiteralPath $Path |
        Where-Object { $_ -match "^$([regex]::Escape($Name))=" } |
        Select-Object -First 1
    if ($line) {
        return $line.Substring($Name.Length + 1).Trim()
    }
    return $null
}

function Invoke-Dvc([string[]]$Arguments) {
    & py -m dvc @Arguments
    if ($LASTEXITCODE -ne 0) {
        throw "DVC command failed: dvc $($Arguments -join ' ')"
    }
}

if (-not (Test-Path -LiteralPath (Join-Path $PSScriptRoot '.dvc\config'))) {
    throw 'DVC is not initialized in this repository.'
}

& py -c 'import dvc, dvc_s3' *> $null
if ($LASTEXITCODE -ne 0) {
    throw 'DVC with S3 support is not installed. Run: py -m pip install -r requirements-dvc.txt'
}

if ($Profile) {
    Invoke-Dvc @('remote', 'modify', '--local', 'customization', 'profile', $Profile)
} else {
    $accessKey = Get-EnvValue $EnvFile 'AWS_ACCESS_KEY_ID'
    $secretKey = Get-EnvValue $EnvFile 'AWS_SECRET_ACCESS_KEY'
    $sessionToken = Get-EnvValue $EnvFile 'AWS_SESSION_TOKEN'

    if (-not $accessKey -or -not $secretKey) {
        throw "AWS credentials are missing in $EnvFile. Pass -Profile or fill AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY."
    }

    Invoke-Dvc @('remote', 'modify', '--local', 'customization', 'access_key_id', $accessKey)
    Invoke-Dvc @('remote', 'modify', '--local', 'customization', 'secret_access_key', $secretKey)
    if ($sessionToken) {
        Invoke-Dvc @('remote', 'modify', '--local', 'customization', 'session_token', $sessionToken)
    }
}

Write-Host 'Local DVC credentials configured. They are stored in ignored .dvc/config.local.'