package main

import (
	"os"
	"path/filepath"
	"strings"
)

// cmdInit points a store (or a subfolder of it) at a Vault gpg key. In place of
// pass's GPG fingerprint, the argument is a "<mount>/<key>" reference into the
// vault-plugin-secrets-gpg engine.
func cmdInit(args []string) error {
	var subpath string
	var refs []string
	for i := 0; i < len(args); i++ {
		a := args[i]
		switch {
		case a == "-p" || a == "--path":
			i++
			if i >= len(args) {
				return &usageError{"Usage: passv init [-p subfolder] <mount>/<key>"}
			}
			subpath = args[i]
		case strings.HasPrefix(a, "--path="):
			subpath = a[len("--path="):]
		default:
			refs = append(refs, a)
		}
	}

	if len(refs) == 0 {
		return &usageError{"Usage: passv init [-p subfolder] <mount>/<key>"}
	}
	if len(refs) > 1 {
		return errf("this Vault-backed store encrypts to a single key; got %d references", len(refs))
	}
	ref := refs[0]
	if _, _, err := splitRef(ref); err != nil {
		return err
	}

	// Verify the key is reachable before committing the store to it.
	v, err := newVault()
	if err != nil {
		return err
	}
	if _, err := v.publicKey(ref); err != nil {
		return err
	}

	s, err := openStore()
	if err != nil {
		return err
	}
	dir := filepath.Join(s.dir, subpath)
	if err := os.MkdirAll(dir, 0o700); err != nil {
		return err
	}
	if err := os.WriteFile(filepath.Join(dir, ".gpg-id"), []byte(ref+"\n"), 0o600); err != nil {
		return err
	}

	where := "Password store"
	if subpath != "" {
		where = "Password store " + subpath
	}
	os.Stdout.WriteString(where + " initialized for " + ref + "\n")
	s.commit("Initialize store for " + ref + subpathSuffix(subpath))
	return nil
}

func subpathSuffix(sub string) string {
	if sub == "" {
		return ""
	}
	return " (" + sub + ")"
}