setup.sh

#!/usr/bin/env bash
set -euo pipefail

EXAMPLE_FILE=".env.example"
TARGET_FILE=".env"

printf 'Setting up Omlorix Code Execution gateway configuration...\n\n'

generate_api_secret() {
  local python_cmd
  local secret

  for python_cmd in python3 python; do
    if command -v "$python_cmd" >/dev/null 2>&1; then
      if secret="$("$python_cmd" - <<'PY' 2>/dev/null
import secrets

print(secrets.token_hex(32))
PY
      )"; then
        printf '%s\n' "$secret"
        return 0
      fi
    fi
  done

  if command -v py >/dev/null 2>&1; then
    if secret="$(py -3 - <<'PY' 2>/dev/null
import secrets

print(secrets.token_hex(32))
PY
    )"; then
      printf '%s\n' "$secret"
      return 0
    fi
  fi

  if command -v openssl >/dev/null 2>&1; then
    openssl rand -hex 32
    return 0
  fi

  printf 'Python 3 or openssl is required to generate API_KEYS. Install one and retry.\n' >&2
  return 1
}

escape_sed_replacement() {
  local value="$1"
  value=${value//\\/\\\\}
  value=${value//&/\\&}
  value=${value//|/\\|}
  printf '%s' "$value"
}

trim_whitespace() {
  local value="$1"
  value="${value#"${value%%[![:space:]]*}"}"
  value="${value%"${value##*[![:space:]]}"}"
  printf '%s' "$value"
}

api_keys_are_strong() {
  local value
  value="$(trim_whitespace "$1")"
  local credential
  local secret
  local normalized_secret
  local found_credential=0
  local credentials=()

  case "$value" in
    ''|,*|*,)
      return 1
      ;;
  esac

  IFS=',' read -r -a credentials <<< "$value"
  for credential in "${credentials[@]}"; do
    credential="$(trim_whitespace "$credential")"
    if [ -z "$credential" ]; then
      return 1
    fi

    found_credential=1
    secret="$credential"
    if [[ "$secret" == *':'* ]]; then
      secret="${secret#*:}"
      secret="$(trim_whitespace "$secret")"
    fi

    normalized_secret="$(printf '%s' "$secret" | tr '[:upper:]' '[:lower:]')"
    case "$normalized_secret" in
      ''|changeme|default|replace-with-a-long-random-secret)
        return 1
        ;;
    esac

    if [ "${#secret}" -lt 32 ]; then
      return 1
    fi
  done

  [ "$found_credential" -eq 1 ]
}

env_file_has_key() {
  local target_file="$1"
  local wanted_key="$2"
  local line
  local normalized_line
  local existing_key

  while IFS= read -r line || [ -n "$line" ]; do
    normalized_line="$(trim_whitespace "$line")"
    case "$normalized_line" in
      ''|'#'*) continue ;;
    esac

    if [[ "$normalized_line" != *'='* ]]; then
      continue
    fi

    existing_key="$(trim_whitespace "${normalized_line%%=*}")"
    if [ "$existing_key" = "$wanted_key" ]; then
      return 0
    fi
  done < "$target_file"

  return 1
}

sed_in_place() {
  local file="$1"
  local expression="$2"
  local tmp
  tmp="$(mktemp "${file}.XXXXXX")"

  trap 'rm -f "$tmp"' RETURN
  sed "$expression" "$file" >"$tmp"
  mv "$tmp" "$file"
  trap - RETURN
}

ensure_default_api_keys() {
  local target_file="$1"
  local current_value=""

  if grep -q '^API_KEYS=' "$target_file"; then
    current_value="$(grep -m1 '^API_KEYS=' "$target_file" | sed 's/^API_KEYS=//')"
    current_value="${current_value%\"}"
    current_value="${current_value#\"}"
    current_value="${current_value%\'}"
    current_value="${current_value#\'}"
  else
    printf 'API_KEYS=\n' >>"$target_file"
  fi

  local normalized_value
  normalized_value="$(printf '%s' "$current_value" | tr '[:upper:]' '[:lower:]')"

  case "$normalized_value" in
    ''|changeme|default|local:changeme|local:default|replace-with-a-long-random-secret|local:replace-with-a-long-random-secret)
      ;;
    *)
      if api_keys_are_strong "$current_value"; then
        printf 'API_KEYS already configured\n'
        return 0
      fi
      ;;
  esac

  local secret
  secret="$(generate_api_secret)"
  if [ -z "$secret" ]; then
    printf 'Failed to generate API_KEYS\n' >&2
    return 1
  fi

  secret="$(escape_sed_replacement "$secret")"
  sed_in_place "$target_file" "s|^API_KEYS=.*|API_KEYS=local:${secret}|"
  printf 'Generated a local API_KEYS secret in %s\n' "$target_file"
}

sync_env_with_example() {
  local example_file="$1"
  local target_file="$2"
  local added=0
  local appended_any=0

  while IFS= read -r line || [ -n "$line" ]; do
    case "$line" in
      ''|'#'*) continue ;;
    esac

    if [[ "$line" != *'='* ]]; then
      continue
    fi

    local key
    key="$(trim_whitespace "${line%%=*}")"

    if [ -z "$key" ]; then
      continue
    fi

    if ! env_file_has_key "$target_file" "$key"; then
      if [ "$appended_any" -eq 0 ]; then
        if [ -s "$target_file" ] && [ "$(tail -c1 "$target_file" 2>/dev/null || true)" != $'\n' ]; then
          printf '\n' >> "$target_file"
        fi
        appended_any=1
      fi
      printf '%s\n' "$line" >> "$target_file"
      added=$((added + 1))
    fi
  done < "$example_file"

  if [ "$added" -gt 0 ]; then
    printf 'Added %d new key(s) from %s into %s\n' "$added" "$example_file" "$target_file"
  fi
}

if [ ! -f "$EXAMPLE_FILE" ]; then
  printf 'Missing %s; cannot create setup configuration.\n' "$EXAMPLE_FILE" >&2
  exit 1
fi

if [ ! -f "$TARGET_FILE" ]; then
  cp "$EXAMPLE_FILE" "$TARGET_FILE"
  printf 'Created %s from %s\n' "$TARGET_FILE" "$EXAMPLE_FILE"
else
  printf '%s already exists; syncing new keys from %s\n' "$TARGET_FILE" "$EXAMPLE_FILE"
  sync_env_with_example "$EXAMPLE_FILE" "$TARGET_FILE"
fi

ensure_default_api_keys "$TARGET_FILE"

cat <<'EONEXT'

Setup complete.

Next steps:
  1. Review .env if you want to adjust ports, limits, or production hardening.
  2. Start the gateway: make up
  3. Check status: make ps
EONEXT