sync.go

package main

import (
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"sort"
	"strings"
	"time"

	"github.com/binsquare/envmap/provider"
)

func syncEnvFile(dest string, records map[string]provider.SecretRecord, merge, keepLocal, force, backup bool) error {
	existing := map[string]string{}
	if b, err := os.ReadFile(dest); err == nil {
		lines := strings.Split(string(b), "\n")
		for _, line := range lines {
			line = strings.TrimSpace(line)
			if line == "" || strings.HasPrefix(line, "#") {
				continue
			}
			parts := strings.SplitN(line, "=", 2)
			if len(parts) != 2 {
				continue
			}
			existing[parts[0]] = parts[1]
		}
	}

	final := map[string]string{}

	// Start with provider values.
	for k, v := range records {
		final[k] = v.Value
	}

	// Merge: keep keys only present in existing.
	if merge {
		for k, v := range existing {
			if _, ok := final[k]; !ok {
				final[k] = v
			}
		}
	}

	// Conflicts: keepLocal overrides provider.
	if keepLocal {
		for k, v := range existing {
			if _, ok := final[k]; ok {
				final[k] = v
			}
		}
	}

	// Backup if requested and file exists.
	if backup {
		if _, err := os.Stat(dest); err == nil {
			bak := dest + ".bak"
			if err := copyFile(dest, bak); err != nil {
				return fmt.Errorf("backup existing file: %w", err)
			}
		}
	}

	// Warn if tracked in git unless forced.
	if !force && isGitTracked(dest) {
		return fmt.Errorf("%s appears tracked by git; rerun with --force to overwrite", dest)
	}

	// Write file.
	lines := []string{
		fmt.Sprintf("# generated by envmap sync %s", time.Now().UTC().Format(time.RFC3339)),
	}
	keys := make([]string, 0, len(final))
	for k := range final {
		keys = append(keys, k)
	}
	sort.Strings(keys)
	for _, k := range keys {
		lines = append(lines, fmt.Sprintf("%s=%s", k, final[k]))
	}
	content := strings.Join(lines, "\n") + "\n"
	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
		return fmt.Errorf("create directory: %w", err)
	}
	if err := os.WriteFile(dest, []byte(content), 0o600); err != nil {
		return fmt.Errorf("write %s: %w", dest, err)
	}
	fmt.Printf("Wrote %s (%d secrets)\n", dest, len(final))
	return nil
}

func checkEnvDrift(dest string, records map[string]provider.SecretRecord) error {
	existing := map[string]string{}
	b, err := os.ReadFile(dest)
	if err != nil {
		return fmt.Errorf("read %s: %w", dest, err)
	}
	lines := strings.Split(string(b), "\n")
	for _, line := range lines {
		line = strings.TrimSpace(line)
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		parts := strings.SplitN(line, "=", 2)
		if len(parts) != 2 {
			continue
		}
		existing[parts[0]] = parts[1]
	}

	providerVals := map[string]string{}
	for k, v := range records {
		providerVals[k] = v.Value
	}

	changed := false
	for k, v := range providerVals {
		if existing[k] != v {
			fmt.Printf("DIFF %s: file=%q provider=%q\n", k, existing[k], v)
			changed = true
		}
	}
	for k, v := range existing {
		if _, ok := providerVals[k]; !ok {
			fmt.Printf("EXTRA %s in file=%q (not in provider)\n", k, v)
			changed = true
		}
	}
	if changed {
		return fmt.Errorf("drift detected between %s and provider", dest)
	}
	fmt.Println("No drift detected.")
	return nil
}

func copyFile(src, dst string) error {
	data, err := os.ReadFile(src)
	if err != nil {
		return err
	}
	return os.WriteFile(dst, data, 0o600)
}

func isGitTracked(path string) bool {
	// Best-effort: check if .git exists and git ls-files marks the path.
	dir := filepath.Dir(path)
	for {
		if _, err := os.Stat(filepath.Join(dir, ".git")); err == nil {
			break
		}
		parent := filepath.Dir(dir)
		if parent == dir {
			return false
		}
		dir = parent
	}
	rel := path
	if abs, err := filepath.Abs(path); err == nil {
		if root, err := filepath.Abs(dir); err == nil {
			if relPath, err := filepath.Rel(root, abs); err == nil {
				rel = relPath
			}
		}
	}
	cmd := exec.Command("git", "ls-files", "--error-unmatch", rel)
	cmd.Stdout = nil
	cmd.Stderr = nil
	if err := cmd.Run(); err != nil {
		return false
	}
	return true
}