#!/usr/bin/env bash
# Edit (or view) a sops-encrypted secrets file with the admin age key.
#
# Usage:
#   ./edit_secrets                      # edit secrets/jupiter.yaml
#   ./edit_secrets secrets/other.yaml   # edit another file
#   ./edit_secrets --show               # decrypt to stdout, no edit
#
# The admin age PRIVATE key must be at $SOPS_AGE_KEY_FILE
# (default ~/.config/sops/age/keys.txt). Never commit that key.
set -euo pipefail

# Locate the repo root (flake dir) regardless of where this script lives on disk.
SCRIPT_DIR="$(cd "$(dirname "$(realpath "$0")")" && pwd)"
REPO="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || dirname "$SCRIPT_DIR")"
cd "$REPO"
export PATH="/nix/var/nix/profiles/default/bin:$PATH"

export SOPS_AGE_KEY_FILE="${SOPS_AGE_KEY_FILE:-$HOME/.config/sops/age/keys.txt}"
if [ ! -f "$SOPS_AGE_KEY_FILE" ]; then
  echo "error: admin age key not found at $SOPS_AGE_KEY_FILE" >&2
  echo "set SOPS_AGE_KEY_FILE or generate one with age-keygen." >&2
  exit 1
fi

show=0
file="secrets/jupiter.yaml"
for arg in "$@"; do
  case "$arg" in
    --show) show=1 ;;
    *) file="$arg" ;;
  esac
done

if [ "$show" -eq 1 ]; then
  exec nix shell nixpkgs#sops -c sops --decrypt "$file"
fi

# sops opens $EDITOR on a temp file and re-encrypts only if it changed.
# Pitfalls that cause "File has not changed, exiting":
#   - $EDITOR unset: no editor is on the `nix shell` PATH -> bundle one.
#   - GUI editor (code/zed) forks and returns instantly -> force --wait.
editor="${VISUAL:-${EDITOR:-}}"
extra=()
case "$editor" in
  "")            editor="nano"; extra=(nixpkgs#nano) ;;   # sane default, bundled
  code|code\ *)  editor="code --wait" ;;                   # VS Code must block
  codium|codium\ *) editor="codium --wait" ;;
  zeditor|zeditor\ *)    editor="zeditor --wait" ;;
esac

export EDITOR="$editor"
exec nix shell nixpkgs#sops "${extra[@]}" -c sops "$file"