#!/bin/bash
exit 0
{{ if eq .chezmoi.osRelease.id "nixos" }}
exit 0
{{ end }}

set -euo pipefail

KEY_DIR="$HOME/.config/chezmoi"
KEY_FILE="$KEY_DIR/key.txt"

mkdir -p "$KEY_DIR"
chmod 700 "$KEY_DIR"

VW_URL="https://vault.benq-serv.top"
bw config server "$VW_URL" >/dev/null

STATUS=$(bw status 2>/dev/null | jq -r '.status')
case "$STATUS" in
  "locked")
    export BW_SESSION=$(bw unlock --raw)
    ;;
  "unauthenticated")
    export BW_SESSION=$(bw login --raw)
    ;;
  *)
    echo "Unknown bw status: $STATUS"
    exit 1
    ;;
esac

bw sync
bw get item "age-keys" \
  | jq -r '.fields[] | select(.name == "private_key") | .value' \
  > "$KEY_FILE"

if [[ -s "$KEY_FILE" ]]; then
    chmod 600 "$KEY_FILE"
else
    exit 1
fi