#!/usr/bin/env bash
# Shared helpers for the infra/dev scripts. Sourced, not run.
# shellcheck disable=SC2034  # variables are used by the scripts that source this file

dev_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
repo_root="$(cd "$dev_dir/../.." && pwd)"

# infra/dev/.env (git-ignored) when it exists, otherwise the committed example.
if [[ -f "$dev_dir/.env" ]]; then env_file="$dev_dir/.env"; else env_file="$dev_dir/.env.example"; fi

die() { printf '%s: %s\n' "$(basename "$0")" "$*" >&2; exit 1; }

# Value of KEY in the env file; DEFAULT (the compose.yaml default, optional) when unset or blank.
env_value() {
  local v
  v="$(sed -n "s/^$1=//p" "$env_file" | tail -n 1)"
  printf '%s\n' "${v:-${2:-}}"
}

compose() {
  docker compose -f "$dev_dir/compose.yaml" --env-file "$env_file" "$@"
}

# Resolve a path from the env file the way compose does: relative to infra/dev/.
dev_path() {
  case "$1" in
    /*) printf '%s\n' "$1" ;;
    *) printf '%s\n' "$dev_dir/$1" ;;
  esac
}

# The Mac's address on the interface that carries the default route (the home Wi-Fi).
lan_address() {
  local iface
  iface="$(route -n get default 2>/dev/null | awk '/interface:/ {print $2}')"
  [[ -n "$iface" ]] && ipconfig getifaddr "$iface" 2>/dev/null
}

# Fill infra/dev/secrets/ (git-ignored, mounted read-only at /secrets) with only the FCM key and the card keys
# folder from KVITT_SECRETS_DIR, so the server container sees no other secret (D-117, D-175). Without the FCM key
# the server starts with push disabled (§10.4); see stage_card_keys for the card keys.
stage_fcm_key() {
  local src stage="$dev_dir/secrets"
  src="$(dev_path "$(env_value KVITT_SECRETS_DIR ../secrets)")/fcm-service-account.json"
  install -d -m 0700 "$stage"
  find "$stage" -mindepth 1 -maxdepth 1 ! -name fcm-service-account.json ! -name cards -exec rm -rf {} +
  if [[ -f "$src" ]]; then
    install -m 0600 "$src" "$stage/fcm-service-account.json"
  else
    rm -f "$stage/fcm-service-account.json"
    echo "$(basename "$0"): no $src; the server starts with push disabled." >&2
  fi
}

# Copy the Enable Banking keys of KVITT_SECRETS_DIR/cards/ (only *.pem) into infra/dev/secrets/cards/ (0700, keys
# 0600), replacing what was there. Without them card features are off, with one warning at start (§10.4, D-175).
stage_card_keys() {
  local src stage="$dev_dir/secrets/cards" key
  src="$(dev_path "$(env_value KVITT_SECRETS_DIR ../secrets)")/cards"
  rm -rf "$stage"
  install -d -m 0700 "$stage"
  if [[ -d "$src" ]]; then
    for key in "$src"/*.pem; do
      [[ -f "$key" ]] && install -m 0600 "$key" "$stage/$(basename "$key")"
    done
  fi
  if [[ -z "$(ls -A "$stage")" ]]; then
    echo "$(basename "$0"): no keys in $src; the server starts with card features off." >&2
  fi
}