#!/bin/sh
set -eu

ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
TEMPLATE="$ROOT/.env.load.example"
ENV_FILE="$ROOT/.env.load"

if [ -f "$ENV_FILE" ]; then
  chmod 600 "$ENV_FILE"
  echo ".env.load already exists; no secret or experiment input was changed."
  exit 0
fi

for command in openssl perl; do
  if ! command -v "$command" >/dev/null 2>&1; then
    echo "Required command is unavailable: $command" >&2
    exit 1
  fi
done

if [ ! -f "$TEMPLATE" ]; then
  echo "Missing tracked template: $TEMPLATE" >&2
  exit 1
fi

umask 077
postgres_password=$(openssl rand -hex 32)
secret_key_base=$(openssl rand -hex 64)
handover_secret=$(openssl rand -hex 64)
release_cookie=$(openssl rand -hex 64)
metrics_token=$(openssl rand -hex 32)
database_url="ecto://wnh_load:${postgres_password}@db/who_need_help_load"
temporary=$(mktemp "${ENV_FILE}.XXXXXX")
trap 'rm -f "$temporary"' EXIT HUP INT TERM

POSTGRES_PASSWORD_VALUE=$postgres_password \
DATABASE_URL_VALUE=$database_url \
SECRET_KEY_BASE_VALUE=$secret_key_base \
HANDOVER_SECRET_VALUE=$handover_secret \
RELEASE_COOKIE_VALUE=$release_cookie \
METRICS_TOKEN_VALUE=$metrics_token \
  perl -0pe '
    s/GENERATE_POSTGRES_PASSWORD/$ENV{POSTGRES_PASSWORD_VALUE}/g;
    s/GENERATE_DATABASE_URL/$ENV{DATABASE_URL_VALUE}/g;
    s/GENERATE_SECRET_KEY_BASE/$ENV{SECRET_KEY_BASE_VALUE}/g;
    s/GENERATE_HANDOVER_SECRET/$ENV{HANDOVER_SECRET_VALUE}/g;
    s/GENERATE_RELEASE_COOKIE/$ENV{RELEASE_COOKIE_VALUE}/g;
    s/GENERATE_METRICS_TOKEN/$ENV{METRICS_TOKEN_VALUE}/g;
  ' "$TEMPLATE" >"$temporary"

if grep -Eq '^[A-Z0-9_]+=GENERATE_' "$temporary"; then
  echo "A secret marker was not replaced; refusing to publish .env.load." >&2
  exit 1
fi

chmod 600 "$temporary"
mv "$temporary" "$ENV_FILE"
trap - EXIT HUP INT TERM
unset postgres_password secret_key_base handover_secret release_cookie metrics_token database_url

echo "Generated independent load-profile secrets in ignored .env.load."