#!/usr/bin/env node
'use strict';

/**
 * 渲染 config/config.toml：读取 .env + 模板，替换密钥占位符。
 * 只做字符串替换，不做 TOML 校验（LibreDesk 启动时会报错）。
 */
const fs = require('fs');
const path = require('path');

const root = path.resolve(__dirname, '..');
const envPath = path.join(root, '.env');
const tplPath = path.join(root, 'config', 'config.toml.example');
const outPath = path.join(root, 'config', 'config.toml');

function parseEnv(text) {
  const out = {};
  for (const line of text.split('\n')) {
    const t = line.trim();
    if (!t || t.startsWith('#')) continue;
    const eq = t.indexOf('=');
    if (eq < 0) continue;
    const key = t.slice(0, eq).trim();
    let value = t.slice(eq + 1).trim();
    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
      value = value.slice(1, -1);
    }
    out[key] = value;
  }
  return out;
}

if (!fs.existsSync(envPath)) {
  console.error('[render-config] .env not found — run scripts/bootstrap.sh first');
  process.exit(1);
}

const env = parseEnv(fs.readFileSync(envPath, 'utf8'));
const required = ['ENCRYPTION_KEY', 'POSTGRES_PASSWORD'];
const missing = required.filter((k) => !env[k]);
if (missing.length) {
  console.error(`[render-config] missing required env: ${missing.join(', ')}`);
  process.exit(1);
}
if (env.ENCRYPTION_KEY.length !== 32) {
  console.error('[render-config] ENCRYPTION_KEY must be 32 chars (openssl rand -hex 16)');
  process.exit(1);
}

const rendered = fs
  .readFileSync(tplPath, 'utf8')
  .replaceAll('__ENCRYPTION_KEY__', env.ENCRYPTION_KEY)
  .replaceAll('__DB_PASSWORD__', env.POSTGRES_PASSWORD);

fs.writeFileSync(outPath, rendered, { mode: 0o600 });
console.log(`[render-config] wrote ${path.relative(root, outPath)} (mode 600)`);