#!/usr/bin/env zsh

matches_any_rule() {
  local path="$1"
  shift
  local regex
  for regex in "$@"; do
    [[ -n "${regex}" ]] || continue
    if [[ "${path}" =~ ${regex} ]]; then
      return 0
    fi
  done
  return 1
}

enc_to_plain() {
  local enc="$1"
  [[ "${enc}" == *.enc.yaml ]] || return 1
  print -r -- "${enc%.enc.yaml}.yaml"
}

plain_to_enc() {
  local plain="$1"
  [[ "${plain}" == *.yaml ]] || return 1
  if [[ "${plain}" == *.enc.yaml ]]; then
    print -r -- "${plain}"
  else
    print -r -- "${plain%.yaml}.enc.yaml"
  fi
}

hmac_sidecar_for_enc() {
  local enc="$1"
  print -r -- "${enc}.sync-hmac"
}

encrypt_plain_to_enc() {
  local plain="$1"
  local enc="$2"
  sops --encrypt --input-type yaml --output-type yaml --output "${enc}" "${plain}"
}

decrypt_enc_to_plain() {
  local enc="$1"
  sops --decrypt "${enc}"
}

compute_hmac_for_file() {
  local path="$1"
  openssl dgst -sha256 -hmac "${SOPS_SYNC_HMAC_KEY}" "${path}" | awk '{print $NF}'
}

compute_hmac_for_stdin() {
  openssl dgst -sha256 -hmac "${SOPS_SYNC_HMAC_KEY}" | awk '{print $NF}'
}

read_sidecar() {
  local sidecar="$1"
  [ -f "${sidecar}" ] || return 1
  tr -d '\r\n' < "${sidecar}"
}

write_sidecar() {
  local sidecar="$1"
  local value="$2"
  print -r -- "${value}" > "${sidecar}"
}

is_sops_encrypted_file() {
  local path="$1"
  [ -f "${path}" ] || return 1
  grep -q 'sops:' "${path}" && grep -q 'ENC\[' "${path}"
}

has_unstaged_changes() {
  local path="$1"
  if git ls-files --error-unmatch -- "${path}" >/dev/null 2>&1; then
    git diff --quiet -- "${path}" >/dev/null 2>&1
    return $?
  fi

  if git diff --cached --name-only -- "${path}" | grep -Fxq "${path}"; then
    git diff --quiet -- "${path}" >/dev/null 2>&1
    return $?
  fi

  return 1
}