#!/bin/bash

set -euo pipefail

if [[ "$#" -gt 0 && ("$1" == "-h" || "$1" == "--help") ]]; then
    cat <<EOF
get: Retrieve and decrypt a secret from the store

Decrypts and outputs a secret value from the global secret store.

Usage:
  get <secret-name>
  get -h|--help

Arguments:
  secret-name    Name of the secret to retrieve

The command will:
1. Check if the secret exists in the store
2. Ensure the private key is available
3. Decrypt the secret using age and output to stdout

Note: Exits with error if secret doesn't exist or decryption fails.
EOF
    exit 0
fi

this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"

if [[ "$#" -lt 1 ]]; then
    >&2 echo "ERROR: Need secret name"
    exit 1
fi
name="$1"

file="$(file_for "${name}")"
if ! [[ -r "${file}" ]]; then
    >&2 echo "ERROR: Secret '$name' not found"
    exit 1
fi

ensure_private_key

age_decrypt "${private_key}" "${file}"