#!/usr/bin/env bash
# Founder-only. Reads a local scaleway.auto.tfvars (or equivalent) and
# writes the four fields to OpenBao. Never prints values. Never commit
# the tfvars file.
set -euo pipefail

TFVARS="${1:-}"
[[ -n "$TFVARS" && -f "$TFVARS" ]] || {
  echo "usage: $0 /path/to/scaleway.auto.tfvars" >&2
  exit 2
}
command -v bao >/dev/null || { echo "missing bao" >&2; exit 2; }

mapfile -t EXPORTS < <(python3 - "$TFVARS" <<'PY'
import re, json, sys
text = open(sys.argv[1], encoding="utf-8").read()
# HCL-ish: key = "value"  (ignore comments and the main.tf provider block)
found = {}
for name, dest in (
    ("access_key", "ACCESS_KEY"),
    ("secret_key", "SECRET_KEY"),
    ("organization_id", "DEFAULT_ORGANIZATION_ID"),
    ("project_id", "DEFAULT_PROJECT_ID"),
):
    m = re.search(rf'(?m)^\s*{name}\s*=\s*"([^"]*)"\s*$', text)
    if not m or not m.group(1) or m.group(1) in {"xxx", "redacted"}:
        sys.stderr.write(f"missing or placeholder field: {name}\n")
        sys.exit(4)
    found[dest] = m.group(1)
for dest, val in found.items():
    print(f"{dest}={json.dumps(val)}")
PY
)

# Write via env to bao without putting values on argv.
# bao kv put supports @file; we use a mode-0600 temp dir.
umask 077
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
for line in "${EXPORTS[@]}"; do
  field="${line%%=*}"
  python3 -c 'import json,os,sys; open(sys.argv[2],"w").write(json.loads(sys.argv[1]))' \
    "${line#*=}" "$tmp/$field"
done

bao kv put platform/workloads/railiance/scaleway/bootstrap \
  ACCESS_KEY=@"$tmp/ACCESS_KEY" \
  SECRET_KEY=@"$tmp/SECRET_KEY" \
  DEFAULT_ORGANIZATION_ID=@"$tmp/DEFAULT_ORGANIZATION_ID" \
  DEFAULT_PROJECT_ID=@"$tmp/DEFAULT_PROJECT_ID"

echo "wrote four fields to platform/workloads/railiance/scaleway/bootstrap"
bao kv metadata get platform/workloads/railiance/scaleway/bootstrap
echo "shred or keep your tfvars; do not commit it"