#!/usr/bin/env bash

set -euo pipefail

AGE_PRIVATE_KEY="$HOME/.ssh/id_ed25519"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

case "${1:-}" in
  env)
    ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
    ;;
  gpg)
    ENCRYPTED_FILE="$SCRIPT_DIR/gpg.age"
    ;;
  data)
    ENCRYPTED_FILE="$SCRIPT_DIR/data.age"
    ;;
  *)
    echo "Usage: $0 {env|gpg}"
    exit 1
    ;;
esac

RECIPIENTS_FILE="$SCRIPT_DIR/recipients.txt"

TMP_FILE=$(mktemp)

cleanup() {
  rm -f "$TMP_FILE"
}
trap cleanup EXIT

if [[ -f "$ENCRYPTED_FILE" ]]; then
  age -d -i "$AGE_PRIVATE_KEY" -o "$TMP_FILE" "$ENCRYPTED_FILE"
fi

"${EDITOR:-vi}" "$TMP_FILE"

age -R "$RECIPIENTS_FILE" -o "$ENCRYPTED_FILE" "$TMP_FILE"

echo "Updated $ENCRYPTED_FILE"