#!/usr/bin/env bash
set -euo pipefail

umask 077
secret_dir="${SECRET_DIR:-secrets}"
mkdir -p "$secret_dir"
chmod 700 "$secret_dir"

generate_secret() {
  local name="$1"
  local path="$secret_dir/$name"
  if [[ -s "$path" ]]; then
    printf 'Kept existing local secret: %s\n' "$path"
    return
  fi
  openssl rand -hex 32 >"$path"
  chmod 600 "$path"
  printf 'Created local secret: %s\n' "$path"
}

generate_secret postgres_bootstrap_password
generate_secret postgres_migrator_password
generate_secret postgres_app_password

if [[ "${1:-}" == "--with-bailian" ]]; then
  bailian_path="$secret_dir/bailian_api_key"
  if [[ -s "$bailian_path" ]]; then
    printf 'Kept existing local secret: %s\n' "$bailian_path"
    exit 0
  fi

  printf 'Paste the NEWLY ROTATED Bailian API key (input is hidden): ' >&2
  IFS= read -r -s bailian_key
  printf '\n' >&2
  if [[ ! "$bailian_key" =~ ^sk-[A-Za-z0-9_-]{20,}$ ]]; then
    printf 'Refused: the value does not look like a Bailian API key.\n' >&2
    exit 2
  fi
  printf '%s' "$bailian_key" >"$bailian_path"
  chmod 600 "$bailian_path"
  unset bailian_key
  printf 'Created local Bailian secret without echoing its value: %s\n' "$bailian_path"
else
  printf 'Bailian key not created. Rotate the exposed key, then rerun with --with-bailian.\n'
fi