#!/usr/bin/env bash
# Materialize databases/cnpg-backup-offsite from OpenBao (RAILIANCE-WP-0015-T02).
# Never prints secret values. Does not place AGE_PRIVATE_KEY in-cluster.
set -euo pipefail

NAMESPACE="${CNPG_NAMESPACE:-databases}"
SECRET_NAME="${CNPG_BACKUP_OFFSITE_SECRET:-cnpg-backup-offsite}"
BAO_PATH="${RAILIANCE_BACKUP_BAO_PATH:-platform/workloads/railiance/backup/offsite-lane}"
AGE_PUBLIC_KEY="${RAILIANCE_BACKUP_AGE_PUBLIC_KEY:-age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz}"
DRY_RUN="${DRY_RUN:-0}"

if ! command -v bao >/dev/null 2>&1; then
  echo "ERROR: bao CLI required" >&2
  exit 1
fi
if ! command -v kubectl >/dev/null 2>&1; then
  echo "ERROR: kubectl required" >&2
  exit 1
fi

if ! bao token lookup >/dev/null 2>&1; then
  echo "ERROR: no valid OpenBao token" >&2
  echo "Run: bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read" >&2
  exit 1
fi

if ! bao kv metadata get "$BAO_PATH" >/dev/null 2>&1; then
  echo "ERROR: cannot read metadata for ${BAO_PATH}" >&2
  exit 1
fi

# Fetch into env without echoing
NC_WEBDAV_TOKEN="$(bao kv get -field=NC_WEBDAV_TOKEN "$BAO_PATH")"
NC_WEBDAV_URL="$(bao kv get -field=NC_WEBDAV_URL "$BAO_PATH")"

if [[ -z "${NC_WEBDAV_TOKEN}" || -z "${NC_WEBDAV_URL}" ]]; then
  echo "ERROR: NC_WEBDAV_TOKEN or NC_WEBDAV_URL empty at ${BAO_PATH}" >&2
  exit 1
fi

echo "cnpg-backup-offsite secret apply"
echo "  namespace: ${NAMESPACE}"
echo "  secret:    ${SECRET_NAME}"
echo "  source:    ${BAO_PATH}"
echo "  keys:      NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PUBLIC_KEY"
echo "  dry-run:   ${DRY_RUN}"

if [[ "$DRY_RUN" == "1" ]]; then
  echo "ok: dry-run — would create/update Secret ${NAMESPACE}/${SECRET_NAME}"
  exit 0
fi

kubectl create secret generic "$SECRET_NAME" \
  -n "$NAMESPACE" \
  --from-literal=NC_WEBDAV_TOKEN="$NC_WEBDAV_TOKEN" \
  --from-literal=NC_WEBDAV_URL="$NC_WEBDAV_URL" \
  --from-literal=AGE_PUBLIC_KEY="$AGE_PUBLIC_KEY" \
  --dry-run=client -o yaml \
  | kubectl apply -f -

# Clear locals
unset NC_WEBDAV_TOKEN NC_WEBDAV_URL

# Non-secret verification
keys="$(kubectl get secret "$SECRET_NAME" -n "$NAMESPACE" -o jsonpath='{.data}' \
  | python3 -c 'import sys,json; print(",".join(sorted(json.load(sys.stdin).keys())))')"
echo "ok: Secret ${NAMESPACE}/${SECRET_NAME} applied (keys: ${keys})"