#!/bin/bash
#
# Phase 8: Secrets Configuration
# Store deployment secrets in a local operator-controlled env file.
#

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPT_DIR}/config.sh"

log_info "=========================================="
log_info "Phase 8: Secrets Configuration"
log_info "=========================================="

SECRETS_DIR="${STATE_DIR}/secrets"
SECRETS_FILE="${SECRETS_DIR}/${ENVIRONMENT}.env"

log_step "8.1 Preparing local secrets file..."
mkdir -p "${SECRETS_DIR}"

if [ ! -f "${SECRETS_FILE}" ]; then
  touch "${SECRETS_FILE}"
  chmod 600 "${SECRETS_FILE}"
  log_success "Created ${SECRETS_FILE}"
else
  chmod 600 "${SECRETS_FILE}"
  log_success "Using existing ${SECRETS_FILE}"
fi

log_step "8.2 Writing known secrets..."
if [ -n "${DATABASE_URL:-}" ] && ! grep -q '^DATABASE_URL=' "${SECRETS_FILE}" 2>/dev/null; then
  printf 'DATABASE_URL=%s\n' "${DATABASE_URL}" >> "${SECRETS_FILE}"
  log_success "Stored DATABASE_URL in ${SECRETS_FILE}"
fi

if ! grep -q '^JWT_SECRET=' "${SECRETS_FILE}" 2>/dev/null; then
  JWT_SECRET=$(openssl rand -base64 32)
  printf 'JWT_SECRET=%s\n' "${JWT_SECRET}" >> "${SECRETS_FILE}"
  log_success "Generated JWT_SECRET in ${SECRETS_FILE}"
else
  log_success "JWT_SECRET already present in ${SECRETS_FILE}"
fi

log_step "8.3 Checking identity provider placeholders..."
for key in OIDC_ISSUER OIDC_CLIENT_ID OIDC_CLIENT_SECRET VC_ISSUER_DID VC_ISSUER_DOMAIN; do
  if grep -q "^${key}=" "${SECRETS_FILE}" 2>/dev/null; then
    log_success "${key} found in ${SECRETS_FILE}"
  else
    log_warning "${key} is not present in ${SECRETS_FILE}"
  fi
done

log_info "Secrets configuration complete"
log_info "Keep ${SECRETS_FILE} out of version control and merge it into the runtime env on the target CT when needed."

# Save state
save_state "phase8" "complete"

log_success "=========================================="
log_success "Phase 8: Secrets Configuration - COMPLETE"
log_success "=========================================="