#!/usr/bin/env bash
# bw-cli.sh — Bitwarden CLI host wrapper (container-based, native Rust binary).
#
# Provides transparent `bw` access on hosts where the CLI is not installed
# natively. Runs the pre-compiled Rust bw binary inside a minimal Docker
# container (debian-slim + ca-certificates, NO Node.js).
#
# All tool execution happens inside the container. Nothing runs on the host
# except this wrapper, which only invokes docker.
#
# Usage:
#   bw-cli.sh status                 Check vault status
#   bw-cli.sh list items             List vault items
#   bw-cli.sh list collections       List collections
#   bw-cli.sh get password "Item"    Retrieve a password
#   bw-cli.sh get totp "Item"        Retrieve a TOTP code
#   bw-cli.sh get item "Item"        Full item JSON
#   bw-cli.sh generate -ulns         Generate a password
#
# Install to ~/.local/bin/bw via:
#   scripts/bw-install.sh
#
# Environment overrides:
#   BW_ENV_FILE   Path to credentials (default: ~/.config/bw/env)
#   BW_IMAGE      Docker image (default: reachableceo-bw-native:2026.7.0)
#   BW_VOLUME     Docker volume for persisted login state
#                 (default: tsys-bw-cli-state)
#   BW_LIB_DIR    Directory containing entrypoint.sh (default: ~/.local/share/bw)

set -euo pipefail

BW_ENV_FILE="${BW_ENV_FILE:-$HOME/.config/bw/env}"
BW_IMAGE="${BW_IMAGE:-reachableceo-bw-native:2026.7.0}"
BW_VOLUME="${BW_VOLUME:-tsys-bw-cli-state}"
BW_LIB_DIR="${BW_LIB_DIR:-$HOME/.local/share/bw}"

# --- Validate prerequisites ---
if [ ! -f "$BW_ENV_FILE" ]; then
    echo "bw: credential file not found: $BW_ENV_FILE" >&2
    echo "    expected BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD, BW_SERVER" >&2
    exit 1
fi

if ! docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
    echo "bw: Docker image not found: $BW_IMAGE" >&2
    echo "    build it: scripts/bw-install.sh" >&2
    exit 1
fi

if [ ! -f "$BW_LIB_DIR/entrypoint.sh" ]; then
    echo "bw: entrypoint script missing: $BW_LIB_DIR/entrypoint.sh" >&2
    echo "    install via: scripts/bw-install.sh" >&2
    exit 1
fi

# --- Load credentials (values are single-quoted in env file) ---
set -a
# shellcheck source=/dev/null
. "$BW_ENV_FILE"
set +a

# --- Create persistent volume for BW CLI login state ---
docker volume create "$BW_VOLUME" >/dev/null 2>&1 || true

# --- Run bw inside the container ---
docker run --rm -i \
    -e BW_CLIENTID \
    -e BW_CLIENTSECRET \
    -e BW_PASSWORD \
    -e BW_SERVER \
    -v "$BW_VOLUME:/root/.config/Bitwarden CLI" \
    -v "$BW_LIB_DIR/entrypoint.sh:/opt/bw/entrypoint.sh:ro" \
    --entrypoint sh \
    "$BW_IMAGE" \
    /opt/bw/entrypoint.sh "$@"