#!/usr/bin/env bash
# Decrypts .env.age to .env using the local age private key
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
ENV_FILE="${PROJECT_ROOT}/.env"
ENV_AGE_FILE="${PROJECT_ROOT}/.env.age"

# Try common key locations
KEY_FILE=""
for loc in "${HOME}/.age/keys.txt" "${PROJECT_ROOT}/keys/age-key.txt" "/opt/Jannik-Cloud/keys/age-key.txt"; do
    if [[ -f "$loc" ]]; then
        KEY_FILE="$loc"
        break
    fi
done

if [[ -z "$KEY_FILE" ]]; then
    echo "ERROR: No age private key found." >&2
    exit 1
fi

if [[ ! -f "$ENV_AGE_FILE" ]]; then
    echo "ERROR: .env.age not found at $ENV_AGE_FILE" >&2
    exit 1
fi

echo "Decrypting .env.age -> .env using key $KEY_FILE ..."
age --decrypt -i "$KEY_FILE" -o "$ENV_FILE" "$ENV_AGE_FILE"
chmod 600 "$ENV_FILE"
echo "Done. .env restored successfully."