#!/usr/bin/env bash
# Decrypts ansible/group_vars/vault.yml and checks all required secrets are present
# and non-empty. Exits non-zero if any are missing.
# Usage: bash scripts/check-vault.sh

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
VAULT_FILE="${REPO_ROOT}/ansible/group_vars/vault.yml"

REQUIRED_KEYS=(
  traefik_dashboard_users
  gitea_db_password
  gitea_secret_key
  gitea_internal_token
  keycloak_db_password
  keycloak_admin_password
  nextcloud_db_password
  nextcloud_admin_password
  roundcube_db_password
  roundcube_des_key
  registry_htpasswd
)

if [ ! -f "${VAULT_FILE}" ]; then
  echo "ERROR: vault file not found at ${VAULT_FILE}" >&2
  echo "       Create it with: ansible-vault create ansible/group_vars/vault.yml" >&2
  exit 1
fi

if ! command -v ansible-vault &>/dev/null; then
  echo "ERROR: ansible-vault not found — install with: pip install ansible" >&2
  exit 1
fi

echo "==> Decrypting vault (you will be prompted for the vault password)"
VAULT_CONTENT=$(ansible-vault view "${VAULT_FILE}")

MISSING=()
for key in "${REQUIRED_KEYS[@]}"; do
  # Match lines like:   key: "value"  or  key: value  — but not  key: ""  or  key: ''  or missing
  if ! echo "${VAULT_CONTENT}" | grep -qE "^${key}:[[:space:]]+[^'\"[:space:]]|^${key}:[[:space:]]+['\"].+['\"]"; then
    MISSING+=("${key}")
  fi
done

if [ ${#MISSING[@]} -gt 0 ]; then
  echo "" >&2
  echo "ERROR: the following secrets are missing or empty in vault.yml:" >&2
  for key in "${MISSING[@]}"; do
    echo "       - ${key}" >&2
  done
  echo "" >&2
  echo "Edit the vault with: ansible-vault edit ansible/group_vars/vault.yml" >&2
  exit 1
fi

echo "    OK — all required secrets are present"