#!/bin/bash

################################################################################
# Encrypted Environment Setup Script
# 
# This script creates encrypted .env files that can only be decrypted by root.
# It uses GPG with AES256 symmetric encryption and stores the key with 
# root-only permissions.
#
# Security Features:
# - AES256 encryption
# - Root-only encryption key (600 permissions)
# - Encrypted .env files stored with 600 permissions
# - Original .env files never stored in git
# - Automatic key generation if not exists
################################################################################

set -e  # Exit on error

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
SECURE_DIR="/root/.tilbudgivern-secure"
KEY_FILE="$SECURE_DIR/encryption.key"

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

check_root() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root"
        echo "Please run: sudo $0"
        exit 1
    fi
}

setup_secure_directory() {
    log_info "Setting up secure directory..."
    
    if [[ ! -d "$SECURE_DIR" ]]; then
        mkdir -p "$SECURE_DIR"
        chmod 700 "$SECURE_DIR"
        log_info "Created secure directory: $SECURE_DIR"
    fi
}

generate_encryption_key() {
    if [[ ! -f "$KEY_FILE" ]]; then
        log_info "Generating new encryption key..."
        # Generate a 256-bit (32-byte) random key
        openssl rand -base64 32 > "$KEY_FILE"
        chmod 600 "$KEY_FILE"
        log_info "Encryption key created: $KEY_FILE"
    else
        log_info "Encryption key already exists: $KEY_FILE"
    fi
}

encrypt_env_file() {
    local env_file=$1
    local encrypted_file="${env_file}.enc"
    
    if [[ ! -f "$env_file" ]]; then
        log_warn "File not found: $env_file (skipping)"
        return
    fi
    
    log_info "Encrypting: $env_file"
    
    # Encrypt using AES-256-CBC with key from file
    openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \
        -in "$env_file" \
        -out "$encrypted_file" \
        -pass file:"$KEY_FILE"
    
    # Set secure permissions on encrypted file
    chmod 600 "$encrypted_file"
    chown root:root "$encrypted_file"
    
    log_info "Created encrypted file: $encrypted_file"
}

main() {
    log_info "Starting encrypted environment setup..."
    
    check_root
    setup_secure_directory
    generate_encryption_key
    
    # Array of .env files to encrypt
    ENV_FILES=(
        "$PROJECT_ROOT/backend/.env"
        "$PROJECT_ROOT/frontend/.env"
        "$PROJECT_ROOT/frontend/.env.production"
        "$PROJECT_ROOT/_config/.env.ordrestyring"
    )
    
    log_info "Encrypting environment files..."
    
    for env_file in "${ENV_FILES[@]}"; do
        if [[ -f "$env_file" ]]; then
            encrypt_env_file "$env_file"
        fi
    done
    
    echo ""
    log_info "✅ Encryption complete!"
    echo ""
    log_info "Security summary:"
    echo "  - Encryption key: $KEY_FILE (root only, 600)"
    echo "  - Encrypted files: *.env.enc (root only, 600)"
    echo "  - Algorithm: AES-256-CBC with PBKDF2 (100,000 iterations)"
    echo ""
    log_warn "IMPORTANT: Keep your .env files in .gitignore"
    log_warn "Only .env.enc files should exist on the server"
    echo ""
    log_info "To decrypt for application use, run:"
    echo "  sudo $SCRIPT_DIR/decrypt-env.sh"
}

main