#!/bin/bash
# Encrypt environment variables for OpenCode
# Works on macOS, Linux, and Windows (Git Bash)
#
# Usage:
#   ./commands/encrypt-env.sh              # Interactive mode
#   ./commands/encrypt-env.sh .env         # From .env file

if [ -n "$BASH_SOURCE" ]; then
    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
elif [ -n "$ZSH_VERSION" ]; then
    SCRIPT_DIR="$(cd "$(dirname "${(%):-%x}")" && pwd)"
else
    SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
fi

PROJECT_DIR="$SCRIPT_DIR/.."
OUTPUT_FILE="$PROJECT_DIR/.env.encrypted"

echo ""
echo "🔐 OpenCode Environment Variable Encryption"
echo ""

# Check if .env file is provided as argument
if [ -n "$1" ] && [ -f "$1" ]; then
    ENV_FILE="$1"
    echo "Reading from: $ENV_FILE"
    ENV_CONTENT=$(cat "$ENV_FILE")
    
    if [ -z "$ENV_CONTENT" ]; then
        echo "❌ File is empty. Exiting."
        exit 1
    fi
else
    # Interactive mode
    echo "This tool will encrypt your API keys for safe storage."
    echo "Leave empty to skip a variable."
    echo ""

    ENV_CONTENT=""

    read -p "GEMINI_API_KEY: " GEMINI_API_KEY
    [ -n "$GEMINI_API_KEY" ] && ENV_CONTENT+="GEMINI_API_KEY=$GEMINI_API_KEY"$'\n'

    read -p "PERPLEXITY_API_KEY: " PERPLEXITY_API_KEY
    [ -n "$PERPLEXITY_API_KEY" ] && ENV_CONTENT+="PERPLEXITY_API_KEY=$PERPLEXITY_API_KEY"$'\n'

    read -p "FAL_KEY: " FAL_KEY
    [ -n "$FAL_KEY" ] && ENV_CONTENT+="FAL_KEY=$FAL_KEY"$'\n'

    read -p "GITHUB_TOKEN: " GITHUB_TOKEN
    [ -n "$GITHUB_TOKEN" ] && ENV_CONTENT+="GITHUB_TOKEN=$GITHUB_TOKEN"$'\n'

    if [ -z "$ENV_CONTENT" ]; then
        echo ""
        echo "❌ No variables entered. Exiting."
        exit 1
    fi
fi

echo ""
read -sp "Enter encryption passphrase (min 8 chars): " PASSPHRASE
echo ""
read -sp "Confirm passphrase: " PASSPHRASE_CONFIRM
echo ""

if [ "$PASSPHRASE" != "$PASSPHRASE_CONFIRM" ]; then
    echo ""
    echo "❌ Passphrases do not match. Exiting."
    exit 1
fi

if [ ${#PASSPHRASE} -lt 8 ]; then
    echo ""
    echo "❌ Passphrase must be at least 8 characters. Exiting."
    exit 1
fi

# Encrypt using OpenSSL AES-256-CBC with PBKDF2
echo "$ENV_CONTENT" | openssl enc -aes-256-cbc -pbkdf2 -salt -out "$OUTPUT_FILE" -pass pass:"$PASSPHRASE"

if [ $? -eq 0 ]; then
    echo ""
    echo "✅ Encrypted to .env.encrypted"
    echo ""
    echo "To load these variables before running opencode:"
    echo "  source commands/load-env.sh"
else
    echo ""
    echo "❌ Encryption failed."
    exit 1
fi