#!/usr/bin/env bash

set -euo pipefail

usage() {
  cat <<'EOF'
Usage:
  apply-env-secret-overrides.sh <env-file> <KEY> [KEY...]

For each KEY, this script reads KEY_B64 from the environment, base64-decodes it,
and upserts KEY=<decoded value> in <env-file>. Empty KEY_B64 values are ignored.
EOF
}

if [[ $# -lt 2 ]]; then
  usage >&2
  exit 1
fi

env_file="$1"
shift

if [[ ! -f "${env_file}" ]]; then
  echo "Missing env file: ${env_file}" >&2
  exit 1
fi

upsert_env_value() {
  local key="$1"
  local value="$2"
  local tmp_file

  tmp_file="$(mktemp "${env_file}.tmp.XXXXXX")"
  awk -v key="${key}" -v value="${value}" '
    BEGIN {
      updated = 0
    }
    /^[[:space:]]*#/ || index($0, "=") == 0 {
      print
      next
    }
    {
      name = $1
      sub(/=.*/, "", name)
      sub(/^[[:space:]]*export[[:space:]]+/, "", name)
      gsub(/^[[:space:]]+|[[:space:]]+$/, "", name)
      if (name == key) {
        print key "=" value
        updated = 1
        next
      }
      print
    }
    END {
      if (!updated) {
        print key "=" value
      }
    }
  ' "${env_file}" > "${tmp_file}"

  mv "${tmp_file}" "${env_file}"
}

for key in "$@"; do
  encoded_var="${key}_B64"
  encoded_value="${!encoded_var:-}"

  if [[ -z "${encoded_value}" ]]; then
    continue
  fi

  if ! decoded_value="$(printf '%s' "${encoded_value}" | base64 -d)"; then
    echo "Invalid base64 value in ${encoded_var}" >&2
    exit 1
  fi

  upsert_env_value "${key}" "${decoded_value}"
done