#!/bin/sh
set -eu
umask 077

ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
env_file=${1:-"$ROOT/.env"}

case "$env_file" in
  /*) ;;
  *) env_file="$ROOT/$env_file" ;;
esac

if [ ! -f "$env_file" ]; then
  echo "Deployment environment does not exist: $env_file" >&2
  exit 1
fi

if [ "$(stat -c '%a' "$env_file")" != 600 ]; then
  echo "Deployment environment must have mode 0600: $env_file" >&2
  exit 1
fi

if [ -n "$(git -C "$ROOT" status --porcelain --untracked-files=no)" ]; then
  echo "Refusing to select a deployment revision from a dirty tracked checkout." >&2
  exit 1
fi

read_env_value() {
  key=$1

  awk -v key="$key" '
    index($0, key "=") == 1 {
      print substr($0, length(key) + 2)
      found = 1
      exit
    }
    END { if (!found) exit 1 }
  ' "$env_file"
}

require_single_key() {
  key=$1
  count=$(awk -v key="$key" 'index($0, key "=") == 1 { count++ } END { print count + 0 }' "$env_file")

  if [ "$count" -ne 1 ]; then
    echo "$key must occur exactly once in $env_file." >&2
    exit 1
  fi
}

deployment_env=$(read_env_value DEPLOYMENT_ENV)
domain=$(read_env_value PHX_HOST)
git_sha=$(git -C "$ROOT" rev-parse --short=12 HEAD)

case "$deployment_env" in
  test)
    required_keys='APP_IMAGE SOCKET_PROXY_IMAGE POSTGIS_IMAGE'
    ;;
  production)
    required_keys='APP_IMAGE SOCKET_PROXY_IMAGE POSTGIS_IMAGE CADDY_IMAGE'
    ;;
  *)
    echo "DEPLOYMENT_ENV must be test or production." >&2
    exit 1
    ;;
esac

for key in $required_keys; do
  require_single_key "$key"
done

target_dir=$(dirname -- "$env_file")
tmp=$(mktemp "$target_dir/.deployment-revision.XXXXXX")
trap 'rm -f "$tmp"' EXIT HUP INT TERM
chmod 600 "$tmp"

DEPLOYMENT_ENV_VALUE=$deployment_env GIT_SHA_VALUE=$git_sha awk '
  BEGIN {
    prefix = ENVIRON["DEPLOYMENT_ENV_VALUE"]
    sha = ENVIRON["GIT_SHA_VALUE"]
    replacement["APP_IMAGE"] = "who-need-help:" prefix "-" sha
    replacement["SOCKET_PROXY_IMAGE"] = "who-need-help:socket-proxy-" prefix "-" sha
    replacement["POSTGIS_IMAGE"] = "who-need-help:postgis-" prefix "-" sha
    if (prefix == "production") {
      replacement["CADDY_IMAGE"] = "who-need-help:caddy-production-" sha
    }
  }
  {
    separator = index($0, "=")
    key = separator > 1 ? substr($0, 1, separator - 1) : ""
    print (key in replacement) ? key "=" replacement[key] : $0
  }
' "$env_file" >"$tmp"

mv "$tmp" "$env_file"
chmod 600 "$env_file"
trap - EXIT HUP INT TERM

case "$deployment_env" in
  test) "$ROOT/scripts/validate-test-env.sh" "$env_file" "$domain" ;;
  production) "$ROOT/scripts/validate-production-env.sh" "$env_file" "$domain" ;;
esac

echo "Selected $deployment_env deployment revision $git_sha without rotating secrets."