#!/bin/sh
set -e

# test "encrypt" binary with cloudkms

# file to encrypt is first parameter, otherwise "/etc/services" is used
TEST_FILE=${1:-/etc/services}

# Requires 'gcloud' (google-cloud-sdk-bin) to be installed,
#   to check if key exists and create it if it does not exist
# Required environment:
#     GOOGLE_APPLICATION_CREDENTIALS must be set in environment to a valid json credentials file
# Optional
#     CLOUDKMS_KEYRING_NAME   key ring name, default "my_keyring"
#     CLOUDKMS_KEY_NAME       key name, default "my_key"
#     KEY_LOCATION            key location (zone), default "global"
#     PROG                    path to 'encrypt' binary, or will find it in $PATH

[ -z "$GOOGLE_APPLICATION_CREDENTIALS" ] \
    && echo "GOOGLE_APPLICATION_CREDENTIALS must be defined" \
    && exit 1
[ ! -f "$GOOGLE_APPLICATION_CREDENTIALS" ] \
    && echo "GOOGLE_APPLICATION_CREDENTIALS points to invalid file $GOOGLE_APPLICATION_CREDENTIALS"\
    && exit 1
! $(gcloud --version >/dev/null 2>&1) \
    && echo "gcloud is missing. The google-cloud-sdk-bin should be installed and initialized"\
    && exit 1

KEYRING_NAME=${CLOUDKMS_KEYRING_NAME:-"my_keyring"}
KEY_NAME=${CLOUDKMS_KEY_NAME:-"my_key"}
KEY_LOCATION=${KEY_LOCATION:-"global"}
# support use case when installed with 'cargo install encrypt-rs'
# If run within ci, PROG will be defined by caller
PROG=${PROG:-$(command -v encrypt)}

if [ -z "$GOOGLE_PROJECT_ID" ]; then
    GOOGLE_PROJECT_ID=$(jq -r ".project_id" $GOOGLE_APPLICATION_CREDENTIALS)
fi

# create the keyring if it doesn't exist
echo Checking for keyring $KEYRING_NAME
gcloud kms keyrings describe $KEYRING_NAME \
    --project $GOOGLE_PROJECT_ID \
    --location $KEY_LOCATION \
    >/dev/null 2>&1 \
    || gcloud kms keyrings create $KEYRING_NAME \
        --project $GOOGLE_PROJECT_ID \
        --location $KEY_LOCATION

# create key if it doesn't exist
echo Checking for key $KEY_NAME
gcloud kms keys describe $KEY_NAME \
    --project $GOOGLE_PROJECT_ID \
    --location $KEY_LOCATION \
    --keyring $KEYRING_NAME \
    >/dev/null 2>&1 \
    || gcloud kms keys create $KEY_NAME \
        --project $GOOGLE_PROJECT_ID \
        --location $KEY_LOCATION \
        --keyring $KEYRING_NAME \
        --purpose encryption

KEEPER_URI="cloudkms:/$GOOGLE_PROJECT_ID/$KEY_LOCATION/$KEYRING_NAME/$KEY_NAME"
echo "Keeper uri: $KEEPER_URI"

# temp file for encrypted output
TMP_ENC=$(mktemp)_enc
# temp file for decrypted output
TMP_DEC=$(mktemp)_dec

# encrypt 
$PROG enc -k "$KEEPER_URI" -o $TMP_ENC $TEST_FILE

# decrypt
$PROG dec -k "$KEEPER_URI" -o $TMP_DEC $TMP_ENC

if [ ! $(cmp $TEST_FILE $TMP_DEC) ]; then
  echo "encrypt-decrypt with cloudkms: Success!"
else
  echo "encrypt-decrypt with cloudkms: ERROR"
fi
ls -l $TEST_FILE $TMP_ENC $TMP_DEC

