#!/bin/sh
# One-shot: populate Infisical with oikos secrets from host .env.
# Runs on the deploy host (mac-mini) where docker-compose reads .env.
# Uses the oikos binary from the repo to talk to Infisical on localhost:8080.
#
# Usage: ./scripts/seed-secrets.sh
#
# Safe to re-run (set is idempotent).

set -e

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_DIR="${REPO_DIR:-$SCRIPT_DIR/..}"
OIKOS_BIN="${OIKOS_BIN:-$REPO_DIR/bin/oikos}"

export OIKOS_INFISICAL_SITE_URL="${OIKOS_INFISICAL_SITE_URL:-http://localhost:8080}"
export OIKOS_INFISICAL_ENV="${OIKOS_INFISICAL_ENV:-dev}"

echo "=== seed-secrets: $(date) ==="

if [ ! -x "$OIKOS_BIN" ]; then
    echo "Building oikos binary..."
    (cd "$REPO_DIR" && go build -o "$OIKOS_BIN" ./cmd/oikos/)
fi

set_count=0
skip_count=0
fail_count=0

seed_key() {
    key="$1"
    env_var="$2"
    value="$(eval echo \"\${$env_var:-}\")"
    if [ -z "$value" ]; then
        echo "SKIP: $key ($env_var empty/missing)"
        skip_count=$((skip_count + 1))
        return
    fi
    if "$OIKOS_BIN" secret set "$key" "$value" 2>/dev/null; then
        echo "SET:  $key"
        set_count=$((set_count + 1))
    else
        echo "FAIL: $key"
        fail_count=$((fail_count + 1))
    fi
}

seed_key "matrix_token"         "OIKOS_MATRIX_TOKEN"
seed_key "approval_hmac-secret" "OIKOS_APPROVAL_HMAC_SECRET"
seed_key "mcp_bearer-token"     "OIKOS_MCP_BEARER_TOKEN"
seed_key "api_token"            "OIKOS_API_TOKEN"
seed_key "oidc_client-secret"   "OIKOS_OIDC_CLIENT_SECRET"
seed_key "openrouter_api-key"   "OPENROUTER_API_KEY"
seed_key "webhook_hmac-secret"  "WEBHOOK_HMAC_SECRET"

echo ""
echo "seed-secrets complete: $set_count set, $skip_count skipped, $fail_count failed"