#!/bin/bash

set -euo pipefail

if [[ "$#" -gt 0 && ("$1" == "-h" || "$1" == "--help") ]]; then
    cat <<EOF
put-local: Store a secret in a localized store

Encrypts data from stdin and stores it in a localized store. The store name
is read from the .szecret metadata file in the file's directory.

Usage:
  put-local <file-path>
  echo "secret-value" | put-local <file-path>
  put-local -h|--help

Arguments:
  file-path    Path where to store the encrypted file

The command will:
1. Read the store name from <directory>/.szecret
2. Retrieve the local store's private key from global store
3. Generate the corresponding public key from the private key
4. Read data from stdin
5. Encrypt the data using age with the local store's public key
6. Store the encrypted data at the specified file path

Note: Will overwrite existing files at the target path.
EOF
    exit 0
fi

this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"

if [[ "$#" -lt 1 ]]; then
    >&2 echo "ERROR: Need file path"
    exit 1
fi

file_path="$1"
target_dir="$(dirname "${file_path}")"
metadata_file="${target_dir}/.szecret"

# Read store name and pubkey from metadata
if ! read_local_metadata "${metadata_file}"; then
    >&2 echo "ERROR: No .szecret metadata in ${target_dir}"
    >&2 echo "Run 'szecret create-local <store-name> ${target_dir}' first"
    exit 1
fi

local_store_name="${_metadata_store}"
expected_pubkey="${_metadata_pubkey}"

ensure_local_store "${local_store_name}"
ensure_age

# Verify pubkey matches
actual_pubkey="$(get_local_public_key "${local_store_name}")"
verify_local_pubkey "${expected_pubkey}" "${actual_pubkey}" "${local_store_name}"

# Get the local private key from the global store
local_private_key="$(get_local_private_key "${local_store_name}")"

# Create a temporary file for the public key (needed because age_encrypt uses pipes)
temp_public_key="$(mktemp)"
trap 'rm -f "${temp_public_key}"' EXIT
age-keygen -y <<<"${local_private_key}" > "${temp_public_key}"

# Encrypt data from stdin to the specified file path using the local store's public key
age_encrypt "${temp_public_key}" "${file_path}"