pre-commit.sh

#!/bin/bash
# Pre-commit hook: Sync kubeconfigs and SSH keys to Bitwarden.
#
# NOTE: Env-var sync has been removed. Secrets are now managed directly in
# Bitwarden and rendered into files by chezmoi templates at apply time.
# To update a secret, edit it in Bitwarden and run `chezmoi apply`.

set -e

DOTFILES_DIR="$(git rev-parse --show-toplevel)"
KUBE_CLUSTERS_DIR="$DOTFILES_DIR/kube/clusters"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Source checksum utilities
source "$DOTFILES_DIR/scripts/checksum-utils.sh"

echo -e "${GREEN}=== Pre-commit hook: Checking sync-back drift ===${NC}"
if ! python3 "$DOTFILES_DIR/scripts/sync-back.py" --check; then
  echo -e "${RED}ERROR: sync-back drift detected${NC}" >&2
  echo -e "${YELLOW}Run: just sync-back-apply${NC}" >&2
  exit 1
fi

echo -e "${GREEN}=== Pre-commit hook: Syncing to Bitwarden ===${NC}"

# STRICT: Require BW_SESSION or FAIL
if [ -z "$BW_SESSION" ]; then
  echo -e "${RED}ERROR: BW_SESSION not set${NC}" >&2
  echo -e "${YELLOW}Run: export BW_SESSION=\$(bw unlock --raw)${NC}" >&2
  exit 1
fi

if ! BW_STATUS_JSON=$(bw status --session "$BW_SESSION" 2>&1); then
  echo -e "${RED}ERROR: Failed to check Bitwarden session status${NC}" >&2
  echo "$BW_STATUS_JSON" >&2
  exit 1
fi
if ! BW_STATUS=$(printf '%s' "$BW_STATUS_JSON" | jq -r '.status' 2>&1); then
  echo -e "${RED}ERROR: Unexpected Bitwarden status response${NC}" >&2
  echo "$BW_STATUS" >&2
  echo "$BW_STATUS_JSON" >&2
  exit 1
fi
if [ "$BW_STATUS" != "unlocked" ]; then
  echo -e "${RED}ERROR: Bitwarden vault is $BW_STATUS${NC}" >&2
  echo -e "${YELLOW}Run: export BW_SESSION=\$(bw unlock --raw)${NC}" >&2
  exit 1
fi

# Get folder ID by name
get_folder_id() {
  local folder_name="$1"
  local folders_json folder_id

  if ! folders_json=$(bw list folders --session "$BW_SESSION" 2>&1); then
    echo -e "${RED}ERROR: Failed to list Bitwarden folders${NC}" >&2
    echo "$folders_json" >&2
    exit 1
  fi

  if ! folder_id=$(printf '%s' "$folders_json" | jq -r --arg folder_name "$folder_name" '.[] | select(.name==$folder_name) | .id' 2>&1); then
    echo -e "${RED}ERROR: Unexpected response while listing Bitwarden folders${NC}" >&2
    echo "$folder_id" >&2
    echo "$folders_json" >&2
    exit 1
  fi

  if [ -z "$folder_id" ] || [ "$folder_id" = "null" ]; then
    echo -e "${RED}ERROR: Folder '$folder_name' not found in Bitwarden${NC}" >&2
    echo -e "${YELLOW}Run: ./scripts/setup-bitwarden.sh to create folders${NC}" >&2
    exit 1
  fi

  echo "$folder_id"
}

# Get folders
KUBECONFIG_FOLDER_ID=$(get_folder_id "dotfiles/kubeconfig")
SSH_KEYS_FOLDER_ID=$(get_folder_id "dotfiles/ssh-keys")

# ─────────────────────────────────────────────────────────────────────────────
# Kubeconfigs
# ─────────────────────────────────────────────────────────────────────────────
echo -e "${GREEN}=== Checking kubeconfigs for changes ===${NC}"

CURRENT_KUBE_CHECKSUM=$(calculate_kube_checksum)

if [ ! -d "$KUBE_CLUSTERS_DIR" ]; then
  echo -e "${YELLOW}Skipping kubeconfig backup (directory not found)${NC}"
elif has_changed "kubeconfigs" "$CURRENT_KUBE_CHECKSUM"; then
  echo -e "${YELLOW}Kubeconfigs changed, syncing to Bitwarden...${NC}"

  if ! KUBE_ITEMS_JSON=$(bw list items --folderid "$KUBECONFIG_FOLDER_ID" --session "$BW_SESSION" 2>&1); then
    echo -e "${RED}ERROR: Failed to list kubeconfig items from Bitwarden${NC}" >&2
    echo "$KUBE_ITEMS_JSON" >&2
    exit 1
  fi

  if ! KUBE_ITEM_ID=$(printf '%s' "$KUBE_ITEMS_JSON" | jq -r '.[] | select(.name=="kubeconfigs") | .id' 2>&1); then
    echo -e "${RED}ERROR: Unexpected response while listing kubeconfig items${NC}" >&2
    echo "$KUBE_ITEM_ID" >&2
    echo "$KUBE_ITEMS_JSON" >&2
    exit 1
  fi

  if [ -z "$KUBE_ITEM_ID" ] || [ "$KUBE_ITEM_ID" = "null" ]; then
    echo -e "${YELLOW}Creating kubeconfigs item in Bitwarden...${NC}"
    if ! TEMPLATE_JSON=$(bw get template item --session "$BW_SESSION" 2>&1); then
      echo -e "${RED}ERROR: Failed to get Bitwarden item template${NC}" >&2
      echo "$TEMPLATE_JSON" >&2
      exit 1
    fi
    if ! ITEM_PAYLOAD=$(printf '%s' "$TEMPLATE_JSON" | jq ".type = 2 | .secureNote.type = 0 | .name = \"kubeconfigs\" | .notes = \"Kubernetes cluster configurations\" | .folderId = \"$KUBECONFIG_FOLDER_ID\"" 2>&1); then
      echo -e "${RED}ERROR: Failed to build kubeconfigs item payload${NC}" >&2
      echo "$ITEM_PAYLOAD" >&2
      exit 1
    fi
    if ! BW_OUTPUT=$(printf '%s' "$ITEM_PAYLOAD" | bw encode | bw create item --session "$BW_SESSION" 2>&1); then
      echo -e "${RED}ERROR: Failed to create kubeconfigs item in Bitwarden${NC}" >&2
      echo "$BW_OUTPUT" >&2
      exit 1
    fi
    KUBE_ITEM_ID=$(printf '%s' "$BW_OUTPUT" | jq -r '.id')
    if [ -z "$KUBE_ITEM_ID" ] || [ "$KUBE_ITEM_ID" = "null" ]; then
      echo -e "${RED}ERROR: Created kubeconfigs item but could not read item id${NC}" >&2
      echo "$BW_OUTPUT" >&2
      exit 1
    fi
  fi

  for config_file in "$KUBE_CLUSTERS_DIR"/*; do
    [ ! -f "$config_file" ] && continue
    [[ "$config_file" == *.sh ]] && continue
    [[ "$(basename "$config_file")" == ".gitkeep" ]] && continue
    [[ "$(basename "$config_file")" == ".DS_Store" ]] && continue

    filename=$(basename "$config_file")
    if ! KUBE_ITEM_JSON=$(bw get item "$KUBE_ITEM_ID" --session "$BW_SESSION" 2>&1); then
      echo -e "${RED}ERROR: Failed to fetch kubeconfigs item from Bitwarden${NC}" >&2
      echo "$KUBE_ITEM_JSON" >&2
      exit 1
    fi
    if ! ATTACHMENT_ID=$(printf '%s' "$KUBE_ITEM_JSON" | jq -r --arg filename "$filename" '.attachments[]? | select(.fileName == $filename) | .id' 2>&1); then
      echo -e "${RED}ERROR: Unexpected kubeconfigs item response from Bitwarden${NC}" >&2
      echo "$ATTACHMENT_ID" >&2
      echo "$KUBE_ITEM_JSON" >&2
      exit 1
    fi

    if [ -n "$ATTACHMENT_ID" ] && [ "$ATTACHMENT_ID" != "null" ]; then
      echo -e "${YELLOW}  Updating: $filename${NC}"
      if ! BW_OUTPUT=$(bw delete attachment "$ATTACHMENT_ID" --itemid "$KUBE_ITEM_ID" --session "$BW_SESSION" 2>&1); then
        if [[ "$BW_OUTPUT" == *"Attachment doesn't exist"* ]]; then
          echo -e "${YELLOW}  Existing attachment entry is stale; uploading fresh: $filename${NC}"
        else
          echo -e "${RED}ERROR: Failed to delete existing kubeconfig attachment '$filename'${NC}" >&2
          echo "$BW_OUTPUT" >&2
          exit 1
        fi
      fi
    else
      echo -e "${GREEN}  Adding: $filename${NC}"
    fi

    if ! BW_OUTPUT=$(bw create attachment --file "$config_file" --itemid "$KUBE_ITEM_ID" --session "$BW_SESSION" 2>&1); then
      echo -e "${RED}ERROR: Failed to upload kubeconfig attachment '$filename'${NC}" >&2
      echo "$BW_OUTPUT" >&2
      exit 1
    fi
  done

  update_checksum "kubeconfigs" "$CURRENT_KUBE_CHECKSUM"
  echo -e "${GREEN}✓ Kubeconfigs synced${NC}"
else
  echo -e "${GREEN}✓ Kubeconfigs unchanged, skipping sync${NC}"
fi

# ─────────────────────────────────────────────────────────────────────────────
# SSH keys
# ─────────────────────────────────────────────────────────────────────────────
echo -e "${GREEN}=== Checking SSH keys for changes ===${NC}"

CURRENT_SSH_CHECKSUM=$(calculate_ssh_checksum)
SSH_DIR="$DOTFILES_DIR/ssh"

if [ ! -d "$SSH_DIR" ]; then
  echo -e "${YELLOW}Skipping SSH key backup (directory not found)${NC}"
elif has_changed "ssh_keys" "$CURRENT_SSH_CHECKSUM"; then
  echo -e "${YELLOW}SSH keys changed, syncing to Bitwarden...${NC}"

  if ! SSH_ITEMS_JSON=$(bw list items --folderid "$SSH_KEYS_FOLDER_ID" --session "$BW_SESSION" 2>&1); then
    echo -e "${RED}ERROR: Failed to list SSH key items from Bitwarden${NC}" >&2
    echo "$SSH_ITEMS_JSON" >&2
    exit 1
  fi

  for key_file in "$SSH_DIR"/*; do
    [ ! -f "$key_file" ] && continue
    [[ "$(basename "$key_file")" == ".gitkeep" ]] && continue
    [[ "$key_file" == *.pub ]] && continue

    filename=$(basename "$key_file")
    if ! grep -q "PRIVATE KEY" "$key_file"; then
      echo -e "${YELLOW}  Skipping $filename (not an SSH private key)${NC}"
      continue
    fi

    item_name="ssh:$filename"
    pub_file="${key_file}.pub"

    if [ -f "$pub_file" ]; then
      public_key=$(cat "$pub_file")
      pub_for_fp="$pub_file"
    else
      if command -v ssh-keygen >/dev/null 2>&1; then
        public_key=$(ssh-keygen -y -f "$key_file" 2>/dev/null || true)
      else
        public_key=""
      fi

      if [ -z "$public_key" ]; then
        echo -e "${YELLOW}  Skipping $filename (missing public key or passphrase-protected)${NC}"
        continue
      fi

      pub_for_fp="$(mktemp)"
      echo "$public_key" >"$pub_for_fp"
    fi

    fingerprint=""
    if command -v ssh-keygen >/dev/null 2>&1; then
      fingerprint=$(ssh-keygen -lf "$pub_for_fp" 2>/dev/null | awk '{print $2}')
    fi

    if [ -z "$fingerprint" ]; then
      echo -e "${YELLOW}  Skipping $filename (could not compute fingerprint)${NC}"
      [ -f "$pub_for_fp" ] && [ "$pub_for_fp" != "$pub_file" ] && rm -f "$pub_for_fp"
      continue
    fi

    [ -f "$pub_for_fp" ] && [ "$pub_for_fp" != "$pub_file" ] && rm -f "$pub_for_fp"

    private_key=$(cat "$key_file")
    item_id=$(echo "$SSH_ITEMS_JSON" | jq -r --arg name "$item_name" '.[] | select(.name==$name) | .id' | head -n 1)

    if [ -z "$item_id" ] || [ "$item_id" = "null" ]; then
      echo -e "${YELLOW}  Creating: $item_name${NC}"
      template_json=$(bw get template item --session "$BW_SESSION")
      payload=$(echo "$template_json" | jq --arg name "$item_name" \
        --arg folder "$SSH_KEYS_FOLDER_ID" \
        --arg private "$private_key" \
        --arg public "$public_key" \
        --arg fp "$fingerprint" \
        '.type=5 | .name=$name | .folderId=$folder | .sshKey={privateKey:$private, publicKey:$public, fingerprint:$fp, keyFingerprint:$fp}')
      printf '%s' "$payload" | bw encode | bw create item --session "$BW_SESSION" >/dev/null
    else
      echo -e "${YELLOW}  Updating: $item_name${NC}"
      item_json=$(bw get item "$item_id" --session "$BW_SESSION")
      updated_json=$(echo "$item_json" | jq --arg private "$private_key" --arg public "$public_key" --arg fp "$fingerprint" \
        '.type=5 | .sshKey.privateKey=$private | .sshKey.publicKey=$public | .sshKey.fingerprint=$fp | .sshKey.keyFingerprint=$fp')
      printf '%s' "$updated_json" | bw encode | bw edit item "$item_id" --session "$BW_SESSION" >/dev/null
    fi
  done

  update_checksum "ssh_keys" "$CURRENT_SSH_CHECKSUM"
  echo -e "${GREEN}✓ SSH keys synced${NC}"
else
  echo -e "${GREEN}✓ SSH keys unchanged, skipping sync${NC}"
fi

# Stage .checksums file for commit
if [ -f "$DOTFILES_DIR/.checksums" ]; then
  git add "$DOTFILES_DIR/.checksums"
fi

# Sync with Bitwarden server
echo -e "${GREEN}Syncing Bitwarden...${NC}"
if ! BW_OUTPUT=$(bw sync --session "$BW_SESSION" 2>&1); then
  echo -e "${RED}ERROR: Failed to sync Bitwarden${NC}" >&2
  echo "$BW_OUTPUT" >&2
  exit 1
fi

echo -e "${GREEN}=== Pre-commit sync complete ===${NC}"
exit 0