#!/usr/bin/env bash
# libredesk — INSTALL-TIME secret hook.
#
# Runs during the install tier AFTER `abra app new` + EXTRA_ENV + `abra app secret generate --all`
# and BEFORE the single `abra app deploy` (lifecycle.py::_run_install_steps). LibreDesk validates
# two secrets with formats that abra's generic generator does not guarantee, so we insert compliant
# values here (at a bumped version — swarm forbids overwriting a secret at the same version) and
# point the .env at them, so the recipe deploys ONCE, healthy, with no reconverge:
#   - enc_key   : exactly 32 hex chars (AES-256 encryption_key)         → openssl rand -hex 16
#   - admin_pwd : 10–72 chars incl. upper+lower+number+special (the app rejects weaker "System"
#                 user passwords, which abra's alphanumeric generator can produce)
# db_password is fine as abra-generated (no special format), so it is left untouched.
#
# Env supplied by the harness:
#   CCCI_APP_DOMAIN — the per-run libredesk app domain (== abra app name)
#   CCCI_APP_ENV    — path to the app's .env (the one `abra app deploy` reads)
set -euo pipefail

: "${CCCI_APP_DOMAIN:?missing}"
ENV_PATH="${CCCI_APP_ENV:?missing}"

# Insert a compliant value for <secret> and repoint SECRET_<VAR>_VERSION at the bumped version.
insert_secret() {
  local secret="$1" env_var="$2" value="$3"
  local cur new num
  cur=$(grep -E "^\s*${env_var}=" "$ENV_PATH" | tail -1 | cut -d= -f2 | tr -d '"\r' || echo "v1")
  cur=${cur:-v1}
  num=$(( ${cur#v} + 1 )); new="v${num}"
  # abra forbids overwriting an existing version; insert at the fresh version. -C creates it, -o
  # allows overwrite if a stale one exists, --no-input for non-interactive.
  local log
  log=$(abra app secret insert "$CCCI_APP_DOMAIN" "$secret" "$new" "$value" --no-input -C -o 2>&1) ||
    log=$(script -qec "abra app secret insert $CCCI_APP_DOMAIN $secret $new $value --no-input -C -o" /dev/null 2>&1) ||
    { echo "  install_steps: abra app secret insert ${secret}@${new} failed: $log"; exit 1; }
  sed -i "s|^\s*${env_var}=.*|${env_var}=${new}|" "$ENV_PATH"
  echo "  install_steps: ${secret} inserted at ${new} (was ${cur})"
}

# 32 hex chars = 16 bytes (AES-256 key LibreDesk expects for encryption_key).
ENC_KEY=$(openssl rand -hex 16)

# 10–72 chars with upper+lower+number+special. Build deterministically-compliant: a fixed
# upper+lower+digit+special prefix plus random hex entropy (lowercase letters + digits).
ADMIN_PWD="Ci$(openssl rand -hex 12)Aa1!"

insert_secret enc_key   SECRET_ENC_KEY_VERSION   "$ENC_KEY"
insert_secret admin_pwd SECRET_ADMIN_PWD_VERSION "$ADMIN_PWD"

echo "  libredesk install_steps: enc_key (32-hex) + admin_pwd (complex) inserted; deploy will use them"