#!/usr/bin/env bash
set -euo pipefail

credentials_dir="${THOUGHTSTREAM_CREDENTIALS_DIR:-$HOME/.config/thoughtstream/credentials}"
destination="$credentials_dir/inspector-basic.env"

if [[ -L "$credentials_dir" ]]; then
  printf 'Refusing symlinked thought stream credentials directory: %s\n' "$credentials_dir" >&2
  exit 1
fi
mkdir -p -m 0700 "$credentials_dir"
chmod 0700 "$credentials_dir"

read -r -p 'Username [cameron]: ' username
username="${username:-cameron}"
if [[ ! "$username" =~ ^[A-Za-z0-9._-]+$ ]]; then
  printf 'Username may use only letters, numbers, dot, underscore, or hyphen.\n' >&2
  exit 1
fi

read -r -s -p 'Password (20+ bytes): ' password
printf '\n'
read -r -s -p 'Confirm password: ' confirmation
printf '\n'
if [[ "$password" != "$confirmation" ]]; then
  printf 'Passwords do not match.\n' >&2
  exit 1
fi
if (( $(printf '%s' "$password" | wc -c) < 20 )); then
  printf 'Password must contain at least 20 UTF-8 bytes.\n' >&2
  exit 1
fi

umask 077
temporary="$(mktemp "$credentials_dir/.inspector-basic.env.tmp.XXXXXX")"
trap 'rm -f "$temporary"; unset password confirmation encoded' EXIT
encoded="$(printf '%s' "$password" | base64 -w 0)"
printf 'PROXY_USER=%s\nPROXY_PASSWORD_B64=%s\nPROXY_BASIC_FALLBACK_ENABLED=1\n' \
  "$username" "$encoded" > "$temporary"
chmod 0600 "$temporary"
mv -f "$temporary" "$destination"
unset password confirmation encoded
trap - EXIT
printf 'Wrote owner-only inspector credentials to %s.\n' "$destination"
printf 'Restart with: systemctl --user restart thoughtstream-inspector-proxy.service\n'