#!/usr/bin/env bash
# Copy silverbullet basicauth SoT → /tmp seed for apply-notes-basicauth.sh.
# Run on magikoopa (or any host with unlocked koopa-admin-secrets-enc).
# Does NOT touch /etc/caddy (no sudo). Does NOT print secret contents.
#
#   bash scripts/notes/prepare-basicauth-seed.sh
#   # then on koopa (after scp seed or shared path):
#   sudo NOTES_AUTH_SEED=/tmp/silverbullet-basicauth-seed.txt \
#     bash …/scripts/caddy/apply-notes-basicauth.sh
set -euo pipefail

OUT="${NOTES_AUTH_SEED_OUT:-/tmp/silverbullet-basicauth-seed.txt}"
SOT_DEFAULT="${HOME}/git/koopa-admin-secrets-enc/koopa/home-hernani/caddy/silverbullet-basicauth.txt"
SOT="${NOTES_AUTH_SOT:-$SOT_DEFAULT}"

[[ -f "$SOT" ]] || {
  echo "ERROR: missing SoT $SOT (unlock git-crypt / set NOTES_AUTH_SOT=)" >&2
  exit 1
}

umask 077
cp -a "$SOT" "$OUT"
chmod 600 "$OUT"
echo "STATUS=ok OUT=$OUT BYTES=$(wc -c <"$OUT" | tr -d ' ') NEXT=scp_or_use_NOTES_AUTH_SEED"
echo "STATUS=hint scp $OUT hernani@koopa:/tmp/ && sudo NOTES_AUTH_SEED=$OUT bash …/apply-notes-basicauth.sh"