#!/bin/sh
# One-shot: populate Infisical with oikos secrets from env vars.
# Designed to run inside the oikos-api container where Infisical is reachable.
# Safe to re-run (set is idempotent).
#
# Usage: docker exec oikos-api-1 /opt/oikos/scripts/seed-secrets.sh
#
# Secrets are read from the container environment (set via docker-compose).
# If a secret is already in Infisical, it is updated in place.

set -e

echo "=== seed-secrets: $(date) ==="

KEYS="
matrix_token:${OIKOS_MATRIX_TOKEN:-}
approval_hmac-secret:${OIKOS_APPROVAL_HMAC_SECRET:-}
mcp_bearer-token:${OIKOS_MCP_BEARER_TOKEN:-}
api_token:${OIKOS_API_TOKEN:-}
oidc_client-secret:${OIKOS_OIDC_CLIENT_SECRET:-}
openrouter_api-key:${OPENROUTER_API_KEY:-}
webhook_hmac-secret:${WEBHOOK_HMAC_SECRET:-}
"

set_count=0
skip_count=0

echo "$KEYS" | while IFS=: read -r key value; do
    [ -z "$key" ] && continue
    if [ -z "$value" ]; then
        echo "SKIP: $key (env var empty/missing)"
        skip_count=$((skip_count + 1))
        continue
    fi
    if oikos secret set "$key" "$value" 2>/dev/null; then
        echo "SET:  $key"
        set_count=$((set_count + 1))
    else
        echo "FAIL: $key"
    fi
done

echo ""
echo "seed-secrets complete: $set_count set, $skip_count skipped"