#!/bin/zsh

# Prompt for service name and environment
read "SERVICE?Service name: "
read "ENV?Environment (dev/qa/prod): "

PREFIX="${ENV}/${SERVICE}"

echo ""
echo "Searching for secrets matching: ${PREFIX}/*"
echo ""

# List all matching secrets
SECRETS_JSON=$(aws secretsmanager list-secrets \
    --filter Key=name,Values="${PREFIX}/" \
    --query 'SecretList[].Name' \
    --output json 2>/dev/null)

if [ $? -ne 0 ] || [ "$SECRETS_JSON" = "[]" ] || [ -z "$SECRETS_JSON" ]; then
    echo "No secrets found for ${PREFIX}/*"
    exit 1
fi

# Extract secret names into an array
SECRET_NAMES=(${(f)"$(echo "$SECRETS_JSON" | python3 -c "import sys,json; [print(s) for s in json.load(sys.stdin)]")"})

echo "Found ${#SECRET_NAMES[@]} secret(s):"
for name in "${SECRET_NAMES[@]}"; do
    echo "  - $name"
done

echo ""

OUTPUT_DIR="${ENV}/${SERVICE}"
mkdir -p "$OUTPUT_DIR"
OUTPUT_FILE="${OUTPUT_DIR}/.env"

: > "$OUTPUT_FILE"

echo "Fetching ${#SECRET_NAMES[@]} secret(s) into ${OUTPUT_FILE}..."
echo ""
count=0
for secret_path in "${SECRET_NAMES[@]}"; do
    count=$((count + 1))
    var_name=$(basename "$secret_path" | tr '[:lower:]' '[:upper:]')
    echo "[${count}/${#SECRET_NAMES[@]}] Fetching ${var_name}..."

    value=$(aws secretsmanager get-secret-value \
        --secret-id "$secret_path" \
        --query 'SecretString' \
        --output text 2>/dev/null)

    if [ $? -eq 0 ]; then
        echo "${var_name}=${value}" >> "$OUTPUT_FILE"
        echo "  -> ok"
    else
        echo "  -> FAILED" >&2
    fi
done

echo ""
echo "Done. Secrets written to ${OUTPUT_FILE}"