#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

# Run from the private Cloudflare Worker repository that serves api.codecr.org.
# CI may supply the three values as masked environment variables. Otherwise this
# script prompts on /dev/tty without echoing the two credentials.

WRANGLER_ENV="${WRANGLER_ENV:-production}"
DEFAULT_SUPPRESSION_API_ENDPOINT="https://api.codecr.org/v1/email/suppressions"

fail() { echo "FAIL: $*" >&2; exit 1; }
command -v npx >/dev/null 2>&1 || fail "npx is required"

read_secret_if_empty() {
  local key="$1" prompt="$2"
  if test -z "${!key:-}"; then
    test -r /dev/tty || fail "$key must be supplied as a masked CI variable"
    local value
    read -r -s -p "$prompt" value </dev/tty
    printf '\n' >/dev/tty
    printf -v "$key" '%s' "$value"
    export "$key"
  fi
}

read_secret_if_empty RESEND_API_KEY "Resend production API key: "
read_secret_if_empty RESEND_WEBHOOK_SECRET "Resend webhook signing secret: "

if test -z "${SUPPRESSION_API_ENDPOINT:-}"; then
  if test -r /dev/tty; then
    read -r -p "Suppression endpoint [$DEFAULT_SUPPRESSION_API_ENDPOINT]: " SUPPRESSION_API_ENDPOINT </dev/tty
  fi
  SUPPRESSION_API_ENDPOINT="${SUPPRESSION_API_ENDPOINT:-$DEFAULT_SUPPRESSION_API_ENDPOINT}"
  export SUPPRESSION_API_ENDPOINT
fi

case "$RESEND_API_KEY" in re_*) ;; *) fail "Resend API key must begin with re_" ;; esac
test "${#RESEND_API_KEY}" -ge 24 || fail "Resend API key is implausibly short"
test "${#RESEND_WEBHOOK_SECRET}" -ge 32 || fail "webhook signing secret is implausibly short"
test "$SUPPRESSION_API_ENDPOINT" = "$DEFAULT_SUPPRESSION_API_ENDPOINT" || fail "suppression endpoint drift"
trap 'unset RESEND_API_KEY RESEND_WEBHOOK_SECRET SUPPRESSION_API_ENDPOINT' EXIT

# Wrangler reads each value from stdin. Values never appear in argv, shell history,
# Git, wrangler.toml, stdout, or this script. Keep EMAIL_SEND_ENABLED=false while
# these secret-created Worker versions are deployed.
printf '%s' "$RESEND_API_KEY" \
  | npx wrangler secret put RESEND_API_KEY --env "$WRANGLER_ENV" >/dev/null
printf '%s' "$RESEND_WEBHOOK_SECRET" \
  | npx wrangler secret put RESEND_WEBHOOK_SECRET --env "$WRANGLER_ENV" >/dev/null
printf '%s' "$SUPPRESSION_API_ENDPOINT" \
  | npx wrangler secret put SUPPRESSION_API_ENDPOINT --env "$WRANGLER_ENV" >/dev/null

echo "PASS: three named Resend production bindings were stored; values were not printed."
echo "VERIFY NAMES ONLY: npx wrangler secret list --env $WRANGLER_ENV"