#!/usr/bin/env bash
set -euo pipefail

: "${BAO_ADDR:?BAO_ADDR is required}"
: "${BAO_ROLE_ID:?BAO_ROLE_ID is required}"
: "${BAO_SECRET_ID:?BAO_SECRET_ID is required}"
: "${OPENBAO_APP:?OPENBAO_APP is required}"

output="${OPENBAO_ENV_FILE:-.openbao-env}"
payload="$(mktemp)"
merged="$(mktemp)"
trap 'rm -f "$payload" "$merged"' EXIT

export BAO_ADDR
BAO_TOKEN="$(bao write -field=token auth/approle/login role_id="$BAO_ROLE_ID" secret_id="$BAO_SECRET_ID")"
export BAO_TOKEN

printf '{}\n' > "$merged"

merge_secret() {
  local path="$1"

  bao kv get -mount=ci -format=json "$path" > "$payload"

  python3 - "$payload" "$merged" <<'PY'
import json
import sys
from pathlib import Path

payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
merged_path = Path(sys.argv[2])
merged = json.loads(merged_path.read_text(encoding="utf-8"))

data = payload.get("data", {})
if isinstance(data, dict) and isinstance(data.get("data"), dict):
    data = data["data"]

if not isinstance(data, dict):
    raise SystemExit("OpenBao response does not contain an object secret payload")

merged.update({key: value for key, value in data.items() if value is not None})
merged_path.write_text(json.dumps(merged), encoding="utf-8")
PY
}

merge_secret "shared/registry"
merge_secret "shared/deploy-ssh"
merge_secret "projects/${OPENBAO_APP}/deploy"
merge_secret "projects/${OPENBAO_APP}/runtime"

python3 - "$merged" "$output" <<'PY'
import json
import re
import shlex
import sys
from pathlib import Path

data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
output_path = Path(sys.argv[2])

if "REGISTRY_USERNAME" in data and "DEPLOY_REGISTRY_USER" not in data:
    data["DEPLOY_REGISTRY_USER"] = data["REGISTRY_USERNAME"]

if "REGISTRY_PASSWORD" in data and "DEPLOY_REGISTRY_TOKEN" not in data:
    data["DEPLOY_REGISTRY_TOKEN"] = data["REGISTRY_PASSWORD"]

name_re = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
lines = [
    "# Generated by scripts/load-openbao-env.sh",
    "# Do not commit this file.",
]

for key in sorted(data):
    if not name_re.match(key):
        raise SystemExit(f"Unsupported environment variable name from OpenBao: {key}")
    value = data[key]
    if isinstance(value, bool):
        value = "true" if value else "false"
    elif not isinstance(value, str):
        value = str(value)
    lines.append(f"export {key}={shlex.quote(value)}")

output_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
output_path.chmod(0o600)
print(f"Loaded {len(lines) - 2} OpenBao values into {output_path}", file=sys.stderr)
PY