param(
    [Parameter(Mandatory=$true)][string]$Server,
    [Parameter(Mandatory=$true)][string]$Owner,
    [Parameter(Mandatory=$true)][string]$Repo,
    [Parameter(Mandatory=$true)][string]$Token
)

$ErrorActionPreference = 'Stop'
$headers = @{ Authorization = "token $Token" }

$latest = Invoke-RestMethod -Headers $headers -Method GET -Uri "$Server/api/v1/repos/$Owner/$Repo/releases/latest"
if (-not $latest -or -not $latest.id) { throw 'Failed to get latest release' }
$rid = [string]$latest.id
$tag = $latest.tag_name
Write-Host "Pruning assets on release id=$rid (tag=$tag)"

$release = Invoke-RestMethod -Headers $headers -Method GET -Uri "$Server/api/v1/repos/$Owner/$Repo/releases/$rid"
$assets = $release.assets
if (-not $assets) { $assets = $release.attachments }

# Allowed asset names
$allowed = @(
    'lib-privatebin-v0.1.1.3-windows-x64.zip',
    'lib-privatebin-v0.1.1.3-windows-x64.zip.sha256',
    'privatebinapi.dll','privatebinapi.dll.sha256',
    'privatebinapi.lib','privatebinapi.lib.sha256',
    'example.exe','example.exe.sha256'
)

if ($assets) {
    foreach ($a in $assets) {
        if ($allowed -notcontains $a.name) {
            $delUrl = "$Server/api/v1/repos/$Owner/$Repo/releases/assets/$($a.id)"
            try {
                Invoke-RestMethod -Headers $headers -Method DELETE -Uri $delUrl | Out-Null
                Write-Host ("Deleted: " + $a.name)
            } catch {
                Write-Host ("Skip delete (" + $a.name + "): " + $_.Exception.Message) -ForegroundColor Yellow
            }
        }
    }
} else {
    Write-Host 'No assets found.'
}

# Re-fetch assets after prune
$release = Invoke-RestMethod -Headers $headers -Method GET -Uri "$Server/api/v1/repos/$Owner/$Repo/releases/$rid"
$assets = $release.assets; if (-not $assets) { $assets = $release.attachments }

# Build markdown with links
$lines = @('# Downloadable artifacts', '')
foreach ($name in $allowed) {
    $a = $assets | Where-Object { $_.name -eq $name } | Select-Object -First 1
    if ($a) {
        # Prefer deterministic download URL pattern
        $url = "$Server/$Owner/$Repo/releases/download/$tag/$name"
        $lines += ("- [$name]($url)")
    }
}

$lines += ''
$lines += '# SHA256 checksums'
foreach ($name in $allowed | Where-Object { $_.EndsWith('.sha256') }) {
    $a = $assets | Where-Object { $_.name -eq $name } | Select-Object -First 1
    if ($a) {
        $url = "$Server/$Owner/$Repo/releases/download/$tag/$name"
        $lines += ("- [$name]($url)")
    }
}

$bodyText = ($lines -join "`n")
$payload = @{ body = $bodyText } | ConvertTo-Json -Depth 3
Invoke-RestMethod -Headers (@{ Authorization = ("token " + $Token); 'Content-Type' = 'application/json' }) -Method PATCH -Uri "$Server/api/v1/repos/$Owner/$Repo/releases/$rid" -Body $payload | Out-Null
Write-Host 'Release notes updated with links.'