#!/usr/bin/env bash
set -euo pipefail
set +x

ENV_FILE="${1:-.env.staging}"
if [ ! -f "$ENV_FILE" ] || [ -L "$ENV_FILE" ]; then
  echo "staging environment file is missing or unsafe: $ENV_FILE" >&2
  exit 1
fi

legacy_pattern='^(OPENAI_API_KEY|ANTHROPIC_API_KEY|DEEPSEEK_API_KEY|LLM_API_KEY|LLM_MODELS_JSON|LLM_BASE_URL|LLM_MODEL|LLM_DEFAULT_MODEL_ID|LLM_PROVIDER_ID|MASTRA_MODEL|MODEL_PROVIDER_[A-Z0-9_]+_API_KEY)='
key_count="$(grep -Ec '^MODEL_PROVIDER_CONFIG_ENCRYPTION_KEY=' "$ENV_FILE" || true)"
if [ "$key_count" -gt 1 ]; then
  echo "duplicate staging model provider encryption key" >&2
  exit 1
fi

if mode="$(stat -c '%a' "$ENV_FILE" 2>/dev/null)"; then
  owner="$(stat -c '%u' "$ENV_FILE")"
  group="$(stat -c '%g' "$ENV_FILE")"
else
  mode="$(stat -f '%Lp' "$ENV_FILE")"
  owner="$(stat -f '%u' "$ENV_FILE")"
  group="$(stat -f '%g' "$ENV_FILE")"
fi
temporary="$(mktemp "${ENV_FILE}.tmp.XXXXXX")"
trap 'rm -f -- "$temporary"' EXIT

grep -Ev "$legacy_pattern" "$ENV_FILE" > "$temporary" || true
if [ "$key_count" -eq 0 ]; then
  key="$(openssl rand -base64 32 | tr -d '\n')"
  [[ "$key" =~ ^[A-Za-z0-9+/]{43}=$ ]] || exit 1
  printf 'MODEL_PROVIDER_CONFIG_ENCRYPTION_KEY=%s\n' "$key" >> "$temporary"
fi

chmod "$mode" "$temporary"
chown "$owner:$group" "$temporary"
mv -f -- "$temporary" "$ENV_FILE"
trap - EXIT