#!/usr/bin/env bash
# init_1password.sh
# Preflight: sign in to 1Password, create the 'knoey' vault if absent,
# and ensure the 'administrator' item (DB master password) exists.
#
# Called by install.sh before the Python installer.  Skipped in --min mode.

set -euo pipefail

# ── helpers ────────────────────────────────────────────────────────────────

_info()  { echo "==> [1Password] $*"; }
_warn()  { echo "    [WARN] $*" >&2; }
_fatal() { echo "    [ERROR] $*" >&2; exit 1; }

VAULT="knoey"
ADMIN_ITEM="administrator"

# ── skip in --min mode ─────────────────────────────────────────────────────

for arg in "$@"; do
  if [[ "$arg" == "--min" ]]; then
    _warn "Skipping 1Password preflight in --min mode."
    exit 0
  fi
done

# ── require op CLI ─────────────────────────────────────────────────────────

if ! command -v op >/dev/null 2>&1; then
  _fatal "1Password CLI (op) not found.
  Install: brew install 1password-cli
  Docs:    https://developer.1password.com/docs/cli"
fi

_info "op CLI found: $(op --version)"

# ── sign in ────────────────────────────────────────────────────────────────

if ! op whoami >/dev/null 2>&1; then
  _info "No active 1Password session. Signing in..."
  op signin
fi

_info "Signed in as: $(op whoami --format json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('email','unknown'))" 2>/dev/null || op whoami)"

# ── create knoey vault if absent ───────────────────────────────────────────

if op vault get "$VAULT" >/dev/null 2>&1; then
  _info "Vault '$VAULT' already exists."
else
  _info "Creating vault '$VAULT'..."
  op vault create "$VAULT"
  _info "Vault '$VAULT' created."
fi

# ── ensure administrator item exists ───────────────────────────────────────

if op item get "$ADMIN_ITEM" --vault "$VAULT" >/dev/null 2>&1; then
  _info "Item '$ADMIN_ITEM' already exists in vault '$VAULT'."
else
  _info "Creating item '$ADMIN_ITEM' in vault '$VAULT' with a generated password..."
  op item create \
    --category login \
    --title "$ADMIN_ITEM" \
    --vault "$VAULT" \
    --generate-password="32,letters,digits"
  _info "Item '$ADMIN_ITEM' created."
fi

# ── export for child processes ─────────────────────────────────────────────

export OP_VAULT="$VAULT"
_info "OP_VAULT=$OP_VAULT"