#!/usr/bin/env bash
# fetch_prole_secrets.sh
#
# Pulls prole.org Google OAuth credentials from 1Password into etc/secrets/
# so the init scripts can consume them via the standard resolve_secret() path.
#
# Items read (Personal vault, category API_CREDENTIAL):
#   svc-prole-org  →  grafana-google-oidc-client-{id,secret}-prole
#   db-prole-org   →  oauth2-proxy-client-{id,secret}-prole
#
# Cookie secret:
#   If already stored as field 'cookie_secret' in db-prole-org, uses that.
#   Otherwise generates a new 32-byte base64 secret, writes it to
#   etc/secrets/oauth2-proxy-cookie-secret-prole, and saves it back to the
#   db-prole-org item so it's durable in 1Password.
#
# Usage:
#   ./etc/fetch_prole_secrets.sh
#   # Then run the init scripts:
#   ./etc/init_grafana_oauth_prole.sh
#   ./etc/init_oauth2_proxy_prole.sh

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
SECRETS_DIR="$REPO_ROOT/etc/secrets"

log() { printf "[%s] %s\n" "$(date +%H:%M:%S)" "$*"; }
die() { log "ERROR: $*" >&2; exit 1; }

command -v op >/dev/null 2>&1 || die "'op' (1Password CLI) not found. Install: brew install 1password-cli"

if ! op account list >/dev/null 2>&1 || ! op vault list >/dev/null 2>&1; then
  log "Not signed in to 1Password — signing in..."
  eval "$(op signin)"
fi

mkdir -p "$SECRETS_DIR"
chmod 700 "$SECRETS_DIR"

write_secret() {
  local file="$SECRETS_DIR/$1" value="$2"
  printf '%s' "$value" > "$file"
  chmod 600 "$file"
  log "  wrote $file"
}

# ── svc-prole-org → Grafana OAuth ────────────────────────────────────────────

log "Fetching svc-prole-org (Grafana / svc.prole.org) ..."
SVC_CLIENT_ID="$(op item get "svc-prole-org" --fields username 2>/dev/null)" \
  || die "Could not read svc-prole-org from 1Password"
SVC_CLIENT_SECRET="$(op item get "svc-prole-org" --fields credential --reveal 2>/dev/null)" \
  || die "Could not read svc-prole-org credential from 1Password"

write_secret "grafana-google-oidc-client-id-prole"     "$SVC_CLIENT_ID"
write_secret "grafana-google-oidc-client-secret-prole" "$SVC_CLIENT_SECRET"

# ── db-prole-org → oauth2-proxy (Studio / db.prole.org) ──────────────────────

log "Fetching db-prole-org (oauth2-proxy / db.prole.org) ..."
DB_CLIENT_ID="$(op item get "db-prole-org" --fields username 2>/dev/null)" \
  || die "Could not read db-prole-org from 1Password"
DB_CLIENT_SECRET="$(op item get "db-prole-org" --fields credential --reveal 2>/dev/null)" \
  || die "Could not read db-prole-org credential from 1Password"

write_secret "oauth2-proxy-client-id-prole"     "$DB_CLIENT_ID"
write_secret "oauth2-proxy-client-secret-prole" "$DB_CLIENT_SECRET"

# ── Cookie secret ─────────────────────────────────────────────────────────────

log "Resolving oauth2-proxy cookie secret ..."
COOKIE_SECRET=""

# Check if already stored in 1Password (may not exist on first run)
COOKIE_SECRET="$(op item get "db-prole-org" --fields label=cookie_secret --reveal 2>/dev/null || true)"

if [[ -z "$COOKIE_SECRET" ]]; then
  log "  No cookie_secret field in db-prole-org — generating new 32-byte secret ..."
  COOKIE_SECRET="$(openssl rand -base64 32)"

  log "  Saving cookie_secret back to db-prole-org in 1Password ..."
  op item edit "db-prole-org" \
    "cookie_secret[password]=${COOKIE_SECRET}" >/dev/null \
    || die "Failed to save cookie_secret to 1Password"
  log "  Saved."
fi

write_secret "oauth2-proxy-cookie-secret-prole" "$COOKIE_SECRET"

# ── Summary ───────────────────────────────────────────────────────────────────

log ""
log "==> All prole.org secrets written to etc/secrets/:"
ls -1 "$SECRETS_DIR/"*-prole 2>/dev/null | while read -r f; do log "    $f"; done
log ""
log "Next steps:"
log "  ./etc/init_grafana_oauth_prole.sh    # applies grafana-google-oidc Secret"
log "  ./etc/init_oauth2_proxy_prole.sh     # deploys oauth2-proxy for db.prole.org"