prole/etc/lib/shell/prole_secrets.sh

#!/usr/bin/env bash

knoe_is_openbao_ref() {
  local v="${1:-}"
  [[ "$v" == '${OPENBAO:'* ]]
}

knoe_is_knoe_secret_ref() {
  local v="${1:-}"
  [[ "$v" == '${KNOE_SECRET:'* ]]
}

knoe_is_secret_ref() {
  local v="${1:-}"
  knoe_is_openbao_ref "$v" || knoe_is_knoe_secret_ref "$v"
}

# Returns 0 when the current value is empty or is a secret reference and therefore
# should be resolved from the configured secret backend.
knoe_secret_needs_resolution() {
  local current="${1:-}"
  [[ -z "$current" ]] || knoe_is_secret_ref "$current"
}

# Pure precedence helper:
# - If current value is a literal non-empty value, keep it.
# - If current is empty or a secret ref, prefer a non-empty fetched value.
knoe_secret_choose_value() {
  local current="${1:-}"
  local fetched="${2:-}"

  if knoe_secret_needs_resolution "$current"; then
    if [[ -n "$fetched" && "$fetched" != "null" ]]; then
      printf '%s' "$fetched"
      return 0
    fi
  fi
  printf '%s' "$current"
}