#!/usr/bin/env bash

get-agekey-public-key-by-name() {
    local target_name="$1"
    local key_file="$2"
    local block_name=""
    local public_key=""

    while IFS= read -r line || [[ -n "$line" ]]; do
        if [[ "$line" == AGE-SECRET-KEY-* ]]; then
            if [[ "$block_name" == "$target_name" && -n "$public_key" ]]; then
                echo "$public_key"
                return 0
            fi
            block_name=""
            public_key=""
        elif [[ "$line" == '# public key:'* ]]; then
            public_key="${line#\# public key: }"
        elif [[ "$line" == '# name:'* ]]; then
            block_name="${line#\# name: }"
        fi
    done < "$key_file"

    return 1
}

init-dotenv-sops() {
    local project_name
    project_name=$(basename -s .git "$(git remote get-url origin 2>/dev/null)" 2>/dev/null)
    project_name=${project_name:-${PWD##*/}}

    local key_name
    key_name=$(echo "${1:-$project_name}" | tr '[:upper:]' '[:lower:]')
    local age_dir="$HOME/.config/sops/age"
    local age_key_file="$age_dir/keys.txt"

    mkdir -p "$age_dir"

    local public_key=""
    if [[ -f ".sops.yaml" ]]; then
        public_key=$(grep -E '^[[:space:]]*age:' ".sops.yaml" | head -1 | awk '{print $2}' | tr -d '"' | tr -d "'")
        echo ".sops.yaml already exists with public key: $public_key"
    fi

    local existing_name_public_key=""
    if [[ -f "$age_key_file" ]]; then
        existing_name_public_key=$(get-agekey-public-key-by-name "$key_name" "$age_key_file" | head -1 | tr -d ' ')
        if [[ -n "$existing_name_public_key" ]]; then
            echo "Found existing age key '$key_name' in $age_key_file."
        fi
    fi

    if [[ -n "$public_key" && -n "$existing_name_public_key" && "$public_key" != "$existing_name_public_key" ]]; then
        echo "Error: .sops.yaml public key ($public_key) does not match existing key '$key_name' in $age_key_file ($existing_name_public_key)."
        return 1
    fi

    if [[ -z "$public_key" && -n "$existing_name_public_key" ]]; then
        public_key="$existing_name_public_key"
        echo "Using existing age key '$key_name' with public key: $public_key"
    fi

    if [[ -z "$public_key" ]]; then
        local keygen_output
        keygen_output=$(age-keygen 2>/dev/null)
        public_key=$(echo "$keygen_output" | grep '^# public key:' | cut -d: -f2 | tr -d ' ')

        {
            echo "# name: $key_name"
            echo "$keygen_output"
        } >> "$age_key_file"
        echo "Generated age key '$key_name' and appended to $age_key_file"
    fi

    if [[ -f "$age_key_file" ]] && ! grep -qF "$public_key" "$age_key_file"; then
        echo "Warning: private key for $public_key not found in $age_key_file"
    fi

    if [[ ! -f ".sops.yaml" ]]; then
        echo "Create .sops.yaml"
        printf "creation_rules:\n  - path_regex: '.*secrets\\.env$'\n    age: '%s'\n" "$public_key" > ".sops.yaml"
    fi

    echo "Age key file: $age_key_file"
    echo "Age key name: $key_name"
    echo "Age public key: $public_key"
    echo "sops will use the key from $age_key_file automatically."
}
ids() {
    init-dotenv-sops "$@"
}
