#!/bin/sh
# run_after_50-secrets.sh -- PRIVATE tier.
#
# Regenerate ~/.config/zsh/secrets.zsh at the end of every `cmp apply`.
#
# The `run_after_` prefix is load-bearing. It guarantees this runs once every
# managed file is on disk, which resolves the deadlock the old repo had: the
# old .zshrc fetched secrets on line 62 using a token that line 58's file had
# not written yet. Ordering by prefix rather than by hope.
#
# This script is a wrapper and nothing else. The work lives in `dotsecrets`,
# which you can also run by hand after rotating a key in bws -- one
# implementation, so the scheduled path and the manual path cannot drift apart
# and start disagreeing about what a valid secrets.zsh looks like.
#
# IT ALWAYS EXITS 0. A machine on a train with no signal must still be able to
# finish an apply. `dotsecrets` leaves an existing secrets.zsh untouched when
# it cannot fetch, so the failure mode here is "yesterday's keys and a warning"
# rather than "the apply died half way through".

set -u
{{ if ne .chezmoi.destDir .chezmoi.homeDir }}
# Rendered only when this apply is aimed somewhere other than the home
# directory -- `chezmoi apply --destination /tmp/whatever`, which is how this
# tier gets tested. `dotsecrets` resolves its own paths from $HOME, so running
# it here would reach straight past the throwaway destination and rewrite the
# real ~/.config/zsh/secrets.zsh. A test that mutates the machine it is
# protecting is not a test.
printf 'run_after_50-secrets: destination is {{ .chezmoi.destDir }}, not the home directory; skipping\n' >&2
exit 0
{{ end }}
DOTSECRETS="{{ .chezmoi.homeDir }}/.local/bin/dotsecrets"

if [ ! -x "$DOTSECRETS" ]; then
	printf 'run_after_50-secrets: %s is missing or not executable; skipping\n' \
		"$DOTSECRETS" >&2
	exit 0
fi

if ! "$DOTSECRETS"; then
	printf 'run_after_50-secrets: refresh failed (see above). The apply itself is fine.\n' >&2
fi

exit 0