#!/bin/sh
set -e

# test "encrypt" binary with cloudkms

# file to encrypt is first parameter, otherwise "/etc/services" is used
TEST_FILE=${1:-/etc/services}

# Environment variables:
# Required
#     GOOGLE_APPLICATION_CREDENTIALS must be set in environment to a valid json credentials file
# Optional
#     KEYRING_NAME   key ring, default "my_keyring"
#     KEY_NAME       key name, default "my_key"
#     KEY_LOCATION   key location (zone), default "global"
#     PROG           path to 'encrypt' binary, or will find it in $PATH

[ -z "$GOOGLE_APPLICATION_CREDENTIALS" ] && echo "GOOGLE_APPLICATION_CREDENTIALS must be defined" && exit 1
KEYRING_NAME=${KEYRING_NAME:-"my_keyring"}
KEY_NAME=${KEY_NAME:-"my_key"}
KEY_LOCATION=${KEY_LOCATION:-"global"}
PROG=${PROG:-$(command -v encrypt)}

# get the project name
GCLOUD_PROJECT=$(gcloud config get-value project)
if [ -z "$GCLOUD_PROJECT" ]; then
	# try to get from credentials json
    gcloud config set project $(jq -r ".project_id" $GOOGLE_APPLICATION_CREDENTIALS)
fi

# create the keyring if it doesn't exist
echo Checking for keyring $KEYRING_NAME
gcloud kms keyrings describe $KEYRING_NAME \
	--project $GCLOUD_PROJECT \
	--location $KEY_LOCATION \
	>/dev/null 2>&1 \
	|| gcloud kms keyrings create $KEYRING_NAME \
		--project $GCLOUD_PROJECT \
	    --location $KEY_LOCATION

# create key if it doesn't exist
echo Checking for key $KEY_NAME
gcloud kms keys describe $KEY_NAME \
	--project $GCLOUD_PROJECT \
	--location $KEY_LOCATION \
	--keyring $KEYRING_NAME \
	>/dev/null 2>&1 \
	|| gcloud kms keys create $KEY_NAME \
	    --project $GCLOUD_PROJECT \
		--location $KEY_LOCATION \
	    --keyring $KEYRING_NAME \
		--purpose encryption


KEEPER_URI="cloudkms:/$GCLOUD_PROJECT/$KEY_LOCATION/$KEYRING_NAME/$KEY_NAME"
echo "Keeper uri: $KEEPER_URI"

# temp file for encrypted output
TMP_ENC=$(mktemp)_enc
# temp file for decrypted output
TMP_DEC=$(mktemp)_dec

# encrypt 
$PROG enc -k "$KEEPER_URI" -o $TMP_ENC $TEST_FILE

# decrypt
$PROG dec -k "$KEEPER_URI" -o $TMP_DEC $TMP_ENC

if [ ! $(cmp $TEST_FILE $TMP_DEC) ]; then
  echo "encrypt-decrypt with cloudkms: Success!"
else
  echo "encrypt-decrypt with cloudkms: ERROR"
fi
ls -l $TEST_FILE $TMP_ENC $TMP_DEC

