#!/usr/bin/env bash
set -euo pipefail

store="${1:-pass}"
no_passphrase=0
[ "${2:-}" = "--no-passphrase" ] && no_passphrase=1

config_dir="$HOME/.docker"
config_file="$config_dir/config.json"

# Identity used for the dedicated docker-creds GPG key. Stable so re-runs
# are idempotent (we look the key up by this uid rather than guessing).
gpg_name="Docker Credential Store"
gpg_email="${USER}@$(hostname)"
gpg_uid="$gpg_name <$gpg_email>"

# --- credsStore in config.json (merge, never clobber auths) -------------
if ! command -v "docker-credential-$store" >/dev/null 2>&1; then
  echo "warning: docker-credential-$store not found in PATH" >&2
  echo "  is docker-credential-helpers installed and the rebuild applied?" >&2
fi

mkdir -p "$config_dir"
python3 - "$config_file" "$store" <<'PY'
import json, os, sys
path, store = sys.argv[1], sys.argv[2]
config = {}
if os.path.exists(path):
    with open(path) as f:
        try:
            config = json.load(f)
        except json.JSONDecodeError:
            config = {}
config["credsStore"] = store
with open(path, "w") as f:
    json.dump(config, f, indent=2)
    f.write("\n")
PY
chmod u+w "$config_file"
echo "Set credsStore = \"$store\" in $config_file"

# The remaining steps only apply to the pass-backed store.
[ "$store" = "pass" ] || { echo "store is '$store'; skipping GPG/pass setup."; exit 0; }

# --- GPG key (generate only if our uid doesn't already have one) --------
if gpg --list-secret-keys "$gpg_uid" >/dev/null 2>&1; then
  echo "GPG key for '$gpg_uid' already exists; skipping generation."
else
  echo "Generating GPG key for '$gpg_uid'..."
  protection="# (passphrase-protected; pinentry will prompt)"
  if [ "$no_passphrase" -eq 1 ]; then
    echo "warning: creating an UNPROTECTED key (--no-passphrase)." >&2
    echo "  anyone who can read ~/.gnupg can decrypt your registry creds." >&2
    protection="%no-protection"
  fi
  gpg --batch --full-generate-key <<EOF
%echo Generating docker-credential key
Key-Type: eddsa
Key-Curve: ed25519
Subkey-Type: ecdh
Subkey-Curve: cv25519
Name-Real: $gpg_name
Name-Email: $gpg_email
Expire-Date: 0
$protection
%commit
%echo done
EOF
fi

# Pull the fingerprint back out for pass.
fpr="$(gpg --list-secret-keys --with-colons "$gpg_uid" \
  | awk -F: '/^fpr:/ {print $10; exit}')"
[ -n "$fpr" ] || { echo "error: could not determine GPG fingerprint" >&2; exit 1; }

# --- pass init (only if the store isn't already initialized) ------------
store_dir="${PASSWORD_STORE_DIR:-$HOME/.password-store}"
if [ -f "$store_dir/.gpg-id" ]; then
  echo "pass already initialized at $store_dir; skipping init."
else
  pass init "$fpr"
fi

echo
echo "Done. Remaining manual step:  docker login"