#!/bin/bash

set -euo pipefail

if [[ "$#" -gt 0 && ("$1" == "-h" || "$1" == "--help") ]]; then
    cat <<EOF
rotate: Generate a new age key and re-encrypt the global secret store

Creates a new age keypair, re-encrypts every secret in the global store with
the new public key, updates the public key file, and stores the new
private key in the key directory.

Usage:
  rotate
  rotate --yes
  rotate -h|--help

Options:
  --yes    Skip interactive confirmation

The command will:
1. Confirm the operation (unless --yes)
2. Decrypt each secret in the store using the current private key
3. Generate a new age keypair
4. Re-encrypt all secrets with the new public key
5. Update the public key file and install the new private key

Note: Interactive command. Commit the updated store files and public key
      wherever the store is tracked,
      and update the private key backup in 1Password when complete.
EOF
    exit 0
fi

this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"

assume_yes=false
if [[ "${1:-}" == "--yes" ]]; then
    assume_yes=true
elif [[ -n "${1:-}" ]]; then
    >&2 echo "ERROR: Unknown argument: $1"
    exit 1
fi

ensure_age
ensure_private_key

old_private_key="${private_key}"
old_public_key="${key_id}"

shopt -s nullglob
store_files=("${store}"/*.age)
shopt -u nullglob
secret_count="${#store_files[@]}"

if [[ "${assume_yes}" != "true" ]]; then
    if [[ ! -t 1 ]]; then
        >&2 echo "ERROR: rotate requires interactive confirmation (use --yes to skip)"
        exit 1
    fi
    >&2 echo "This will generate a new age key and re-encrypt ${secret_count} secret(s)."
    >&2 echo "Current public key: ${old_public_key}"
    >&2 printf "Continue? [y/N] "
    local_confirm=""
    read -r local_confirm </dev/tty
    if [[ "${local_confirm}" != [yY] ]]; then
        >&2 echo "Aborted."
        exit 1
    fi
fi

staging="$(mktemp -d "${TMPDIR:-/tmp}/szecret-rotate.XXXXXX")"
temp_private_key="$(mktemp -u "${TMPDIR:-/tmp}/szecret-rotate-key.XXXXXX")"
temp_public_key="$(mktemp "${TMPDIR:-/tmp}/szecret-rotate-pub.XXXXXX")"

cleanup() {
    rm -rf "${staging}"
    rm -f "${temp_private_key}" "${temp_public_key}"
}
trap cleanup EXIT

age-keygen -o "${temp_private_key}" 2>/dev/null
new_public_key="$(age-keygen -y "${temp_private_key}")"
echo "${new_public_key}" > "${temp_public_key}"

for secret_file in "${store_files[@]}"; do
    secret_name="$(basename "${secret_file}" .age)"
    age_decrypt "${old_private_key}" "${secret_file}" \
        | age_encrypt "${temp_public_key}" "${staging}/${secret_name}.age"
done

for secret_file in "${store_files[@]}"; do
    secret_name="$(basename "${secret_file}" .age)"
    mv "${staging}/${secret_name}.age" "${secret_file}"
done

echo "${new_public_key}" > "${public_key}"

installed_private_key="${private_key_dir}/${new_public_key}"
mv "${temp_private_key}" "${installed_private_key}"
temp_private_key=""
chmod 600 "${installed_private_key}" 2>/dev/null || true

cat <<EOF

Rotation complete.

  Old public key: ${old_public_key}
  New public key: ${new_public_key}
  Secrets re-encrypted: ${secret_count}
  New private key: ${installed_private_key}

Next steps:
  1. Commit the updated store and $(basename "${public_key}")
  2. Update the szecret private key in 1Password

The old private key remains at ${old_private_key} until you remove it.
EOF