prole/etc/lib/shell/prole_secrets.sh

#!/usr/bin/env bash

prole_is_openbao_ref() {
  local v="${1:-}"
  [[ "$v" == '${OPENBAO:'* ]]
}

prole_is_prole_secret_ref() {
  local v="${1:-}"
  [[ "$v" == '${PROLE_SECRET:'* ]]
}

prole_is_secret_ref() {
  local v="${1:-}"
  prole_is_openbao_ref "$v" || prole_is_prole_secret_ref "$v"
}

# Returns 0 when the current value is empty or is a secret reference and therefore
# should be resolved from the configured secret backend.
prole_secret_needs_resolution() {
  local current="${1:-}"
  [[ -z "$current" ]] || prole_is_secret_ref "$current"
}

# Pure precedence helper:
# - If current value is a literal non-empty value, keep it.
# - If current is empty or a secret ref, prefer a non-empty fetched value.
prole_secret_choose_value() {
  local current="${1:-}"
  local fetched="${2:-}"

  if prole_secret_needs_resolution "$current"; then
    if [[ -n "$fetched" && "$fetched" != "null" ]]; then
      printf '%s' "$fetched"
      return 0
    fi
  fi
  printf '%s' "$current"
}