#!/usr/bin/env bash
set -euo pipefail

# This is the only production writer for the dedicated control-plane machine
# credential volume. It never receives, prints, or exports a secret value.
BASE_DIR="${BASE_DIR:-/home/m/assistant-deploy}"
REPO_DIR="${REPO_DIR:-$BASE_DIR/repo}"
ENV_FILE="${ENV_FILE:-$BASE_DIR/production-compose.env}"
COMPOSE_FILE="$REPO_DIR/deploy/docker-compose.prod.yml"
VOLUME="assistant_control_plane_service_secrets"
ACTION="${1:-ensure}"
CREDENTIAL="${MACHINE_CREDENTIAL:-control-plane}"
SECRET_ROOT="/run/control-plane-secrets"
VOLUME="assistant_control_plane_service_secrets"
if [[ "$CREDENTIAL" == "acceptance-harness" ]]; then
  SECRET_ROOT="/run/core-secrets"
  VOLUME="assistant_core_secrets"
fi

case "$ACTION" in
  ensure|rotate) ;;
  *) echo "unsupported machine credential action" >&2; exit 2 ;;
esac

[[ -f "$ENV_FILE" ]] || { echo "production compose environment is missing" >&2; exit 1; }
[[ -f "$COMPOSE_FILE" ]] || { echo "production compose file is missing" >&2; exit 1; }

compose() { docker compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@"; }

# `docker volume create` is idempotent and does not inspect or expose content.
docker volume create "$VOLUME" >/dev/null
revision="$(git -C "$REPO_DIR" rev-parse HEAD)"
ASSISTANT_SOURCE_REVISION="$revision" compose build --build-arg "SOURCE_REVISION=$revision" secret-control-plane >/dev/null

if [[ "$ACTION" == "rotate" ]]; then
  # Only bounded, non-secret rotation reasons can reach the audit trail.
  reason="${ROTATION_REASON:-owner-requested-rotation}"
  case "$reason" in
    owner-requested-rotation|exposure-detected) ;;
    *) echo "invalid rotation reason" >&2; exit 2 ;;
  esac
  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps -e "SECRET_CONTROL_PLANE_ROOT=$SECRET_ROOT" secret-control-plane -credential "$CREDENTIAL" -reason "$reason" rotate
else
  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps -e "SECRET_CONTROL_PLANE_ROOT=$SECRET_ROOT" secret-control-plane -credential "$CREDENTIAL" ensure
fi