#!/usr/bin/env bash
# Edit the shared vault safely: lock, back up, decrypt to a private temp file,
# run your command on it, check the YAML, re-encrypt, and swap it in at once.
# The command gets the plaintext path as $VAULT_PLAIN (also appended as the
# last argument). Never use `ansible-vault edit`.
#   bin/vault-run python3 my_edit.py
#   bin/vault-run nvim
set -euo pipefail
. "$(dirname "$0")/_common.sh"
[ $# -gt 0 ] || { echo "usage: bin/vault-run <command...>" >&2; exit 2; }
vault="$main_checkout/group_vars/all/vault.yml"
pass="$main_checkout/vault_pass"
av="$main_checkout/.venv/bin/ansible-vault"
take_lock vault
backups="$HOME/Documents/backups/ansible-vault"; mkdir -p "$backups"
cp -p "$vault" "$backups/vault.yml.$(date +%Y%m%d-%H%M%S)"
tmp=$(mktemp -d "$lock_dir/vault.XXXXXX"); trap 'shred -u "$tmp"/* 2>/dev/null; rm -rf "$tmp"' EXIT
export VAULT_PLAIN="$tmp/vault.yml"
"$av" decrypt --vault-password-file "$pass" --output "$VAULT_PLAIN" "$vault" >/dev/null
"$@" "$VAULT_PLAIN"
"$main_checkout/.venv/bin/python" -c 'import sys,yaml; yaml.safe_load(open(sys.argv[1]))' "$VAULT_PLAIN"
"$av" encrypt --vault-password-file "$pass" --output "$tmp/vault.enc" "$VAULT_PLAIN" >/dev/null
chmod --reference="$vault" "$tmp/vault.enc" 2>/dev/null || true
mv "$tmp/vault.enc" "$vault"
echo "vault updated"