#!/usr/bin/env ruby
require 'openssl'
require 'base64'

unless ENV['TEACHABLE_SECRET_KEY']
  abort 'Please set TEACHABLE_SECRET_KEY'
end

UNENCRYPTED_FILE = '.env'
ENCRYPTED_FILE = '.env.encrypted'
ALGORITHM = 'AES-256-CBC'

case ARGV.first
when 'encrypt'
  File.open(ENCRYPTED_FILE, 'w') do |encrypted_file|
    File.foreach(UNENCRYPTED_FILE) do |line|
      if line.chomp =~ /\A([A-Z_]+)=(.+)\z/
        key = $1
        decrypted_value = $2
        cipher = OpenSSL::Cipher.new(ALGORITHM).encrypt
        cipher.pkcs5_keyivgen(ENV['TEACHABLE_SECRET_KEY'])
        encrypted_value = Base64.urlsafe_encode64([cipher.update(decrypted_value) + cipher.final].pack('m'))
        encrypted_file.puts "#{key}=#{encrypted_value}"
      else
        encrypted_file.puts line
      end
    end
  end
when 'decrypt'
  File.open(UNENCRYPTED_FILE, 'wb') do |unencrypted_file|
    File.foreach(ENCRYPTED_FILE) do |line|
      if line.chomp =~ /\A([A-Z_]+)=(.+)\z/
        key = $1
        encrypted_value = $2
        cipher = OpenSSL::Cipher.new(ALGORITHM).decrypt
        cipher.pkcs5_keyivgen(ENV['TEACHABLE_SECRET_KEY'])
        decrypted_value = cipher.update(Base64.urlsafe_decode64(encrypted_value).unpack('m')[0]) + cipher.final
        unencrypted_file.puts "#{key}=#{decrypted_value}"
      else
        unencrypted_file.puts line
      end
    end
  end
when nil
  abort 'Usage: ./scripts/environment-vars [encrypt|decrypt]'
else
  abort "Unrecognized command: #{ARGV.first.inspect}"
end