#!/usr/bin/env bash
# encrypt-secrets.sh — encrypt secrets/ directory to secrets.enc/ using age
#
# Usage:
#   ./encrypt-secrets.sh [SECRETS_DIR] [AGE_PUBLIC_RECIPIENT_OR_FILE]
#
# SECRETS_DIR                plaintext secrets directory (default: ./secrets)
# AGE_PUBLIC_RECIPIENT_OR_FILE  age public recipient or public-recipient file
#                            (default: registered keys/age.pub)
#
# Encrypts each *.env file (and pi.enc if present) to
# secrets.enc/<component>/<filename>.age. Prefer passing a public age recipient
# for normal bootstrap; the private key is needed only for decrypt/apply.
#
# After a successful encrypt, shreds the plaintext secrets directory unless
# --no-shred is passed.
#
# Run after gen-secrets.sh to store secrets safely in the repo.
# Commit secrets.enc/ to git.

set +x
set -euo pipefail
umask 077

SECRETS_DIR="${1:-./secrets}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
AGE_RECIPIENT_OR_KEY="${2:-$SCRIPT_DIR/../../keys/age.pub}"
NO_SHRED=false
for arg in "$@"; do [[ "$arg" == "--no-shred" ]] && NO_SHRED=true; done

if [[ ! -d "$SECRETS_DIR" ]]; then
    echo "ERROR: source secrets directory is unavailable." >&2
    echo "Run gen-secrets.sh first." >&2
    exit 1
fi

resolve_recipient() {
    local source="$1"
    if [[ "$source" == age1* ]]; then
        printf '%s\n' "$source"
        return 0
    fi
    if [[ ! -f "$source" ]]; then
        echo "ERROR: public recipient file is unavailable." >&2
        echo "Pass an age public recipient such as age1... or a file containing it." >&2
        return 1
    fi
    # Never derive public metadata by loading private custody material.
    if grep -q 'AGE-SECRET-KEY-' "$source"; then
        echo "ERROR: encryption requires a public recipient, never a private-key file." >&2
        return 1
    fi
    local recipient
    recipient=$(grep -m1 '^age1' "$source" || true)
    if [[ -n "$recipient" ]]; then
        printf '%s\n' "$recipient"
        return 0
    fi
    echo "ERROR: public recipient is missing from the supplied file." >&2
    return 1
}

PUBKEY=$(resolve_recipient "$AGE_RECIPIENT_OR_KEY")
printf '' | age -r "$PUBKEY" >/dev/null 2>&1 || { echo "ERROR: invalid public recipient." >&2; exit 1; }

ENC_DIR="$(dirname "$SECRETS_DIR")/secrets.enc"
mkdir -p "$ENC_DIR"

echo "Encrypting secrets → $ENC_DIR/"
echo "Recipient: $PUBKEY"
echo ""

count=0
for component_dir in "$SECRETS_DIR"/*/; do
    component=$(basename "$component_dir")
    mkdir -p "$ENC_DIR/$component"
    for f in "$component_dir"*; do
        [[ -f "$f" ]] || continue
        fname=$(basename "$f")
        out="$ENC_DIR/$component/$fname.age"
        age -r "$PUBKEY" -o "$out" "$f"
        echo "  encrypted: $component/$fname → secrets.enc/$component/$fname.age"
        count=$((count + 1))
    done
done

echo ""
echo "$count file(s) encrypted to $ENC_DIR/"
echo ""

if [[ "$NO_SHRED" == false ]]; then
    echo "Shredding plaintext secrets..."
    find "$SECRETS_DIR" -type f -exec shred -u {} \;
    rm -rf "$SECRETS_DIR"
    echo "Done. Plaintext secrets shredded."
else
    echo "(--no-shred: plaintext kept at $SECRETS_DIR)"
fi
echo ""
echo "Next: commit secrets.enc/ to git."