#!/usr/bin/env bash

extract-agekey-block() {
    local target_public_key="$1"
    local key_file="$2"
    local -a block_lines=()
    local block_public_key=""

    while IFS= read -r line || [[ -n "$line" ]]; do
        if [[ "$line" == AGE-SECRET-KEY-* ]]; then
            block_lines+=("$line")
            if [[ "$block_public_key" == "$target_public_key" ]]; then
                printf '%s\n' "${block_lines[@]}"
                return 0
            fi
            block_lines=()
            block_public_key=""
        elif [[ "$line" == '# public key:'* ]]; then
            block_public_key="${line#\# public key: }"
            block_lines+=("$line")
        elif [[ "$line" == '#'* ]]; then
            block_lines+=("$line")
        fi
    done < "$key_file"

    return 1
}

store-agekey-to-keepass() {
    local project_name
    project_name=$(basename -s .git "$(git remote get-url origin 2>/dev/null)" 2>/dev/null)
    project_name=${project_name:-${PWD##*/}}

    local key_name
    key_name=$(echo "${1:-$project_name}" | tr '[:upper:]' '[:lower:]')
    local age_key_file="$HOME/.config/sops/age/keys.txt"
    local keepass_entry="age/$key_name"
    local attachment_name="keys.txt"

    if [[ ! -f "$age_key_file" ]]; then
        echo "Age key file not found: $age_key_file"
        return 1
    fi

    local public_key
    public_key=$(grep -E '^[[:space:]]*age:' ".sops.yaml" 2>/dev/null | head -1 | awk '{print $2}' | tr -d '"' | tr -d "'")
    if [[ -z "$public_key" ]]; then
        echo "Could not determine public key from .sops.yaml"
        return 1
    fi

    local key_block
    key_block=$(mktemp)
    if ! extract-agekey-block "$public_key" "$age_key_file" > "$key_block"; then
        echo "Could not find age key block for $public_key"
        rm -f "$key_block"
        return 1
    fi

    local secret_key
    secret_key=$(grep '^AGE-SECRET-KEY-' "$key_block" | head -1)
    if [[ -z "$secret_key" ]]; then
        echo "Could not extract secret key from key block"
        rm -f "$key_block"
        return 1
    fi

    read -r -s -p "Enter password to unlock $KEEPASS_DATABASE_FILE: " keepass_database_pass
    echo

    if echo "$keepass_database_pass" | keepassxc-cli show \
        --key-file "$KEEPASS_DATABASE_KEY_FILE" \
        --quiet \
        "$KEEPASS_DATABASE_FILE" \
        "$keepass_entry" >/dev/null 2>&1; then

        echo "Entry '$keepass_entry' already exists."
        echo "Removing existing $attachment_name attachment (if any)..."
        echo "$keepass_database_pass" | keepassxc-cli attachment-rm \
            --key-file "$KEEPASS_DATABASE_KEY_FILE" \
            --quiet \
            "$KEEPASS_DATABASE_FILE" \
            "$keepass_entry" \
            "$attachment_name" 2>/dev/null

        echo "Updating entry password..."
        printf '%s\n%s\n' "$keepass_database_pass" "$secret_key" | keepassxc-cli edit \
            --key-file "$KEEPASS_DATABASE_KEY_FILE" \
            --quiet \
            --password-prompt \
            "$KEEPASS_DATABASE_FILE" \
            "$keepass_entry"
    else
        echo "Creating new entry: $keepass_entry"
        printf '%s\n%s\n' "$keepass_database_pass" "$secret_key" | keepassxc-cli add \
            --key-file "$KEEPASS_DATABASE_KEY_FILE" \
            --quiet \
            --password-prompt \
            "$KEEPASS_DATABASE_FILE" \
            "$keepass_entry"
    fi

    echo "Attaching $attachment_name file..."
    echo "$keepass_database_pass" | keepassxc-cli attachment-import \
        --key-file "$KEEPASS_DATABASE_KEY_FILE" \
        --quiet \
        "$KEEPASS_DATABASE_FILE" \
        "$keepass_entry" \
        "$attachment_name" \
        "$key_block"

    rm -f "$key_block"
    echo "Successfully saved age key '$key_name' to '$keepass_entry'."
}
satk() {
    store-agekey-to-keepass "$@"
}
