#!/bin/sh
set -eu

cd "$(dirname "$0")/.."
. ./deploy/vector/secret-policy.sh

if [ "$#" -ne 2 ]; then
  echo "usage: $0 OLD_SECRET_FILE NEW_SECRET_FILE" >&2
  exit 2
fi

absolute_file() {
  directory=$(CDPATH= cd -- "$(dirname -- "$1")" && pwd)
  printf '%s/%s\n' "$directory" "$(basename -- "$1")"
}

old_secret=$(absolute_file "$1")
new_secret=$(absolute_file "$2")
validate_secret_file "$old_secret" old_bootstrap_secret
validate_secret_file "$new_secret" new_bootstrap_secret
if [ "$old_secret" -ef "$new_secret" ]; then
  echo "old and new secret files must be distinct" >&2
  exit 2
fi

project=${COMPOSE_PROJECT_NAME:-thothii}
replacement=$(mktemp "${old_secret}.rotate.XXXXXX")
trap 'rm -f "$replacement"' EXIT HUP INT TERM
cp "$new_secret" "$replacement"
chmod 0600 "$replacement"

docker compose --env-file deploy/env/local.env -f compose.yaml -f deploy/compose.local-vector.yaml \
  --project-name "$project" --profile local-vector run --rm --no-deps \
  --user 0:0 \
  --entrypoint /opt/venv/bin/python \
  --volume "$old_secret:/run/secrets/bootstrap-old:ro" \
  --volume "$new_secret:/run/secrets/bootstrap-new:ro" \
  --volume "$(pwd)/deploy/vector/rotate-bootstrap-password.py:/opt/thoth/rotate-bootstrap-password.py:ro" \
  core /opt/thoth/rotate-bootstrap-password.py \
  /run/secrets/bootstrap-old /run/secrets/bootstrap-new

mv -f "$replacement" "$old_secret"
trap - EXIT HUP INT TERM

echo "Deployment bootstrap secret atomically replaced only after verified database login."
echo "Re-run: docker compose --env-file deploy/env/local.env -f compose.yaml -f deploy/compose.local-vector.yaml --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"