#!/usr/bin/env bash
set -Eeuo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
ENC_FILE="${ZHCT_OSS_ENCRYPTED_CONFIG:-$REPO_ROOT/config/oss/aliyun-config.json.enc}"
TARGET_FILE="${ZHCT_OSS_TARGET_CONFIG:-$HOME/.aliyun/config.json}"

if [[ ! -f "$ENC_FILE" ]]; then
  echo "[oss-config] encrypted config not found: $ENC_FILE" >&2
  exit 1
fi

command -v openssl >/dev/null 2>&1 || {
  echo "[oss-config] openssl not found" >&2
  exit 1
}

PASS_FILE="${ZHCT_OSS_PASSPHRASE_FILE:-}"
PASS_ARG=()

if [[ -n "${ZHCT_OSS_CONFIG_PASSPHRASE:-}" ]]; then
  PASS_ARG=(-pass "env:ZHCT_OSS_CONFIG_PASSPHRASE")
elif [[ -n "$PASS_FILE" && -f "$PASS_FILE" ]]; then
  PASS_ARG=(-pass "file:$PASS_FILE")
else
  read -r -s -p "OSS config decrypt passphrase: " ZHCT_OSS_CONFIG_PASSPHRASE
  echo
  export ZHCT_OSS_CONFIG_PASSPHRASE
  PASS_ARG=(-pass "env:ZHCT_OSS_CONFIG_PASSPHRASE")
fi

mkdir -p "$(dirname "$TARGET_FILE")"
tmp="$(mktemp "${TMPDIR:-/tmp}/zhct-aliyun-config.XXXXXX.json")"
trap 'rm -f "$tmp"' EXIT

openssl enc -d -aes-256-cbc -pbkdf2 -iter 200000 -salt \
  -in "$ENC_FILE" \
  -out "$tmp" \
  "${PASS_ARG[@]}"

python3 -m json.tool "$tmp" >/dev/null

if [[ -f "$TARGET_FILE" ]]; then
  backup="${TARGET_FILE}.bak.$(date +%Y%m%d%H%M%S)"
  cp "$TARGET_FILE" "$backup"
  chmod 600 "$backup"
  echo "[oss-config] backup existing config: $backup"
fi

cp "$tmp" "$TARGET_FILE"
chmod 600 "$TARGET_FILE"
echo "[oss-config] restored encrypted OSS/Aliyun config to: $TARGET_FILE"