#!/usr/bin/env bash
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${root}"

in_file="${1:-secrets/token.txt}"
out_file="${2:-secrets/forgejo-api-token.age}"

rules_file="${EVERY_CHANNEL_AGE_RULES_FILE:-${root}/secrets.nix}"
identity_file="${EVERY_CHANNEL_AGE_IDENTITY_FILE:-$HOME/.config/every.channel/keys/founder_ed25519}"

if [[ ! -f "${in_file}" ]]; then
  echo "error: input file not found: ${in_file}" >&2
  exit 2
fi
if [[ ! -f "${rules_file}" ]]; then
  echo "error: agenix RULES file not found: ${rules_file}" >&2
  exit 2
fi
if [[ ! -f "${identity_file}" ]]; then
  echo "error: agenix identity file not found: ${identity_file}" >&2
  exit 2
fi

if ! command -v agenix >/dev/null 2>&1; then
  echo "error: agenix not found in PATH (run: nix develop)" >&2
  exit 2
fi
if ! command -v ssh-keygen >/dev/null 2>&1; then
  echo "error: ssh-keygen not found in PATH" >&2
  exit 2
fi

# Verify that the configured identity corresponds to the recipient in secrets.nix.
founder_key="$(
  sed -nE 's/^[[:space:]]*founder[[:space:]]*=[[:space:]]*"([^"]+)".*/\\1/p' secrets.nix | head -n 1
)"
if [[ -z "${founder_key}" ]]; then
  echo "error: could not parse founder key from secrets.nix" >&2
  exit 2
fi

if ! grep -q "\"${out_file}\"" "${rules_file}"; then
  echo "error: no rule for ${out_file} in ${rules_file}" >&2
  echo "hint: add it to secrets.nix or pass a different output path" >&2
  exit 2
fi

priv_line="$(ssh-keygen -y -f "${identity_file}" 2>/dev/null || true)"
if [[ -z "${priv_line}" ]]; then
  echo "error: unable to derive public key from identity file: ${identity_file}" >&2
  echo "hint: if the key is passphrase-protected, run an interactive shell or provide a different identity" >&2
  exit 2
fi
priv_pub="$(printf '%s\n' "${priv_line}" | cut -d' ' -f1-2)"
founder_pub="$(printf '%s\n' "${founder_key}" | cut -d' ' -f1-2)"
if [[ "${priv_pub}" != "${founder_pub}" ]]; then
  echo "error: identity public key does not match secrets recipient" >&2
  echo "identity_file: ${identity_file}" >&2
  echo "identity_pub:  ${priv_pub}" >&2
  echo "recipient_pub: ${founder_pub}" >&2
  echo "hint: set EVERY_CHANNEL_AGE_IDENTITY_FILE to the correct private key path" >&2
  exit 2
fi

tmp_dec="$(mktemp "${TMPDIR:-/tmp}/ec-agenix-dec.XXXXXX")"
trap 'rm -f "${tmp_dec}"' EXIT

# Encrypt: non-interactive mode reads plaintext from stdin.
RULES="${rules_file}" cat "${in_file}" | agenix -e "${out_file}" -i "${identity_file}" >/dev/null

# Decrypt and verify byte-for-byte equality.
RULES="${rules_file}" agenix -d "${out_file}" -i "${identity_file}" > "${tmp_dec}"
if ! cmp -s "${tmp_dec}" "${in_file}"; then
  echo "error: verification failed: decrypted secret does not match input file" >&2
  exit 2
fi

rm -f "${in_file}"
echo "ok: wrote ${out_file} and removed ${in_file} after verification"
