#!/usr/bin/env bash
# =============================================================================
# Replaces every "change-me..." placeholder in .env with a freshly generated
# secret.
#
# config/settings/prod.py refuses to start on a placeholder value, so this is
# what makes the very first `make up` both work and be safe: nobody ends up
# running a real deployment on the credentials published in .env.example.
#
#   scripts/generate_secrets.sh [path-to-env]   (default: .env)
#
# Only placeholders are touched - a value you have already set is left alone,
# so re-running this is safe and never invalidates working credentials.
# =============================================================================
set -Eeuo pipefail

ENV_FILE="${1:-.env}"

[[ -f "${ENV_FILE}" ]] || { echo "No ${ENV_FILE} to update." >&2; exit 1; }

# `openssl rand -base64` is available anywhere Docker is; tr strips the
# characters that would need quoting inside a URL-shaped DATABASE_URL.
random() { openssl rand -base64 48 | tr -d '\n=+/' | cut -c1-"${1:-50}"; }

changed=0
for key in DJANGO_SECRET_KEY POSTGRES_PASSWORD ELASTIC_PASSWORD; do
  current="$(grep -E "^${key}=" "${ENV_FILE}" | head -1 | cut -d= -f2- || true)"

  case "${current,,}" in
    *change-me*|*changeme*|'')
      # 64 chars for the signing key (prod.py enforces >= 50), 32 for the
      # service passwords.
      length=32
      [[ "${key}" == "DJANGO_SECRET_KEY" ]] && length=64
      value="$(random "${length}")"
      # `|` as the sed delimiter: generated values never contain it.
      sed -i "s|^${key}=.*|${key}=${value}|" "${ENV_FILE}"
      echo "  generated ${key}"
      changed=1
      ;;
    *)
      echo "  kept ${key} (already set)"
      ;;
  esac
done

if [[ "${changed}" -eq 1 ]]; then
  echo "Secrets written to ${ENV_FILE}. It is gitignored - back it up somewhere safe."
fi