#!/bin/bash
# =============================================================================
# officer-setup — the environment file
# =============================================================================
#
# Definitions only.
#
# ── No secrets are written here ──
#
# Every encryption and signing key lives in the secret store — a 0600 SQLite file
# at $OFFICER_ROOT/secrets/officer-keys.db, one key per purpose, created on first
# use. See docs/secret-store.md and the Secrets section of officer-setup.sh.
#
# So this file holds no credential except POSTGRES_URL, which is a connection
# string to a database bound to loopback.
#
# ── Derived, not asked ──
#
# DATA_PATH, OFFICER_ITEMS_DIR and HOME_DIR are gone too, and this time nothing
# replaces them. The platform derives the install root as the parent of its own
# working directory, so data/, capabilities/ and dockers/ follow from the layout
# on disk, and the owner's home comes from the OS. They were three environment
# variables that had to agree with each other and with the directory tree.

[[ -n "${OFFICER_SETUP_ENV_LOADED:-}" ]] && return 0
OFFICER_SETUP_ENV_LOADED=1

env_file() { echo "$(platform_dir)/.env"; }

env_exists() { [[ -f "$(env_file)" ]]; }

# One value out of an existing .env, without sourcing it — the file holds
# secrets and arbitrary shell would run as root.
env_get() {
  [[ -r "$(env_file)" ]] || return 0
  awk -F= -v k="$1" '
    $1 == k {
      v = substr($0, index($0, "=") + 1)
      gsub(/^"|"$/, "", v)
      print v
      exit
    }' "$(env_file)"
}

write_env() {
  local dest
  dest="$(env_file)"

  [[ -f "$dest" ]] && cp -a "$dest" "${dest}.before-officer-setup"

  # Restrictive from the moment it exists rather than chmod'd afterwards, so the
  # secrets are never briefly world-readable. Restored straight after: umask is
  # not scoped to a function, and leaving it at 077 would quietly make every file
  # a later section creates owner-only.
  local prior_umask
  prior_umask="$(umask)"
  umask 077
  cat >"$dest" <<ENVF
# Written by officer-setup.
#
# Everything Officer reads at runtime. Kept at 0600 and owned by ${USERNAME}: it
# holds the token-signing secret and the database credential.

PORT="${ENV_PORT}"

# Where Officer is reached from a browser. Not derivable — see the section.
PUBLIC_URL="${ENV_PUBLIC_URL}"

POSTGRES_URL="${POSTGRES_URL}"

ENVF

  umask "$prior_umask"

  chown "${USERNAME}:$(user_group)" "$dest"
  chmod 600 "$dest"
  return 0
}