#!/usr/bin/env bash
# Run OpenTofu with TF_VAR_* creds injected from Infisical /tofu/.
# Usage: infisical login && INFISICAL_PROJECT_ID=<id> ./itofu.sh <init|plan|apply|...>
set -euo pipefail

INFISICAL_PROJECT_ID="${INFISICAL_PROJECT_ID:-}"
INFISICAL_ENV="${INFISICAL_ENV:-prod}"
TOFU_PATH="/tofu"
PLAN_FILE="${WEOWN_TOFU_PLAN:-plan.tfplan}"

: "${INFISICAL_PROJECT_ID:?INFISICAL_PROJECT_ID not set. Export it (e.g. from site.conf) before running itofu.sh.}"

command -v infisical >/dev/null 2>&1 || { echo "ERROR: infisical CLI not found." >&2; exit 1; }
command -v tofu      >/dev/null 2>&1 || { echo "ERROR: tofu not found." >&2; exit 1; }
infisical export --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" --path="$TOFU_PATH" >/dev/null 2>&1 || {
  echo "ERROR: cannot read $INFISICAL_PROJECT_ID $INFISICAL_ENV $TOFU_PATH — run 'infisical login' and check your access." >&2; exit 1; }
[ "$#" -ge 1 ] || { echo "usage: ./itofu.sh <init|plan|apply|output|destroy|...> [args]" >&2; exit 1; }

irun() { infisical run --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" --path="$TOFU_PATH" -- "$@"; }

# S3 backend reads AWS_* env on every state op — so ALL tofu calls go through trun.
# shellcheck disable=SC2016
trun() { irun bash -c 'export AWS_ACCESS_KEY_ID="$TF_VAR_spaces_access_key" AWS_SECRET_ACCESS_KEY="$TF_VAR_spaces_secret_key"; exec tofu "$@"' itofu "$@"; }

case "$1" in
  init)
    shift
    # shellcheck disable=SC2016
    irun bash -c 'export AWS_ACCESS_KEY_ID="$TF_VAR_spaces_access_key" AWS_SECRET_ACCESS_KEY="$TF_VAR_spaces_secret_key"; exec tofu init -reconfigure \
      -backend-config="sse_customer_key=$TF_VAR_spaces_encryption_key" "$@"' itofu "$@"
    ;;
  plan)
    shift
    trun plan -out="$PLAN_FILE" "$@"
    ;;
  apply)
    shift
    if [ "$#" -eq 0 ] && [ -f "$PLAN_FILE" ]; then
      set +e; trun apply "$PLAN_FILE"; rc=$?; set -e
      rm -f "$PLAN_FILE"
      exit "$rc"
    fi
    trun apply "$@"
    ;;
  *)
    trun "$@"
    ;;
esac