dot_functions

#!/usr/bin/env zsh

# Internal: returns 0 if the first argument is -h/--help. Used by the public
# functions below to print their usage and bail out.
_is_help() {
  [[ "$1" == "-h" || "$1" == "--help" ]]
}

# Unlock the Bitwarden vault and export the session as BW_SESSION.
bw-session() {
  if _is_help "$1"; then
    echo "Usage: ${funcstack[1]}"
    echo "Unlock the Bitwarden vault and export the session key as BW_SESSION."
    return 0
  fi

  echo "Unlocking Bitwarden and exporting session key as BW_SESSION..." >&2
  local session
  session=$(bw unlock --raw) || { echo "bw unlock failed" >&2; return 1; }
  export BW_SESSION="$session"
}

# Populate BWS_* env vars from the 'bws' Bitwarden item.
bws-env() {
  if _is_help "$1"; then
    echo "Usage: ${funcstack[1]}"
    echo "Read the 'bws' Bitwarden item and export BWS_ACCESS_TOKEN,"
    echo "BWS_PROJECT_ID, and BWS_ORGANIZATION_ID (unlocking the vault first if"
    echo "needed). Already-set variables are left untouched."
    return 0
  fi

  if [ -z "$BW_SESSION" ]; then
    bw-session || return 1
  fi

  local item
  item=$(bw get item bws) || { echo "failed to fetch 'bws' item" >&2; return 1; }

  if [ -z "$BWS_ACCESS_TOKEN" ]; then
    echo "Getting Bitwarden Secrets access token and setting as BWS_ACCESS_TOKEN..." >&2
    export BWS_ACCESS_TOKEN=$(jq -r '.fields[] | select(.name=="bws_access_token") | .value' <<<"$item")
  fi
  if [ -z "$BWS_PROJECT_ID" ]; then
    echo "Getting Bitwarden Secrets project ID and setting as BWS_PROJECT_ID..." >&2
    export BWS_PROJECT_ID=$(jq -r '.fields[] | select(.name=="bws_project_id") | .value' <<<"$item")
  fi
  if [ -z "$BWS_ORGANIZATION_ID" ]; then
    echo "Getting Bitwarden Secrets organization ID and setting as BWS_ORGANIZATION_ID..." >&2
    export BWS_ORGANIZATION_ID=$(jq -r '.fields[] | select(.name=="bws_organization_id") | .value' <<<"$item")
  fi
}

# Create a Bitwarden secret in the configured project.
bws-sc() {
  local usage="Usage: ${funcstack[1]} SECRET_KEY SECRET_VALUE
Create a secret in the Bitwarden Secrets project (BWS_PROJECT_ID).
Runs bws-env first if the project ID is not yet set."
  if _is_help "$1"; then echo "$usage"; return 0; fi
  if [ $# -ne 2 ]; then echo "$usage" >&2; return 1; fi

  if [ -z "$BWS_PROJECT_ID" ]; then
    bws-env || return 1
  fi

  local secret_key=$1
  local secret_value=$2

  bws secret create "$secret_key" "$secret_value" "$BWS_PROJECT_ID"
}

# Look up a Bitwarden secret's value by its key.
bws-sg() {
  local usage="Usage: ${funcstack[1]} SECRET_KEY
Print the value of the Bitwarden secret whose key matches SECRET_KEY.
Runs bws-env first if the access token is not yet set."
  if _is_help "$1"; then echo "$usage"; return 0; fi
  if [ $# -ne 1 ]; then echo "$usage" >&2; return 1; fi

  if [ -z "$BWS_ACCESS_TOKEN" ]; then
    bws-env || return 1
  fi

  local secret_key=$1
  local value
  value=$(bws secret list -o json | jq -r --arg key "$secret_key" \
    '.[] | select(.key == $key) | .value') || return 1

  if [ -z "$value" ]; then
    echo "no secret found with key '$secret_key'" >&2
    return 1
  fi

  echo "$value"
}

# Delete a Bitwarden secret by its key.
bws-sd() {
  local usage="Usage: ${funcstack[1]} SECRET_KEY
Delete the Bitwarden secret whose key matches SECRET_KEY, after confirming.
Refuses if more than one secret has that key.
Runs bws-env first if the access token is not yet set."
  if _is_help "$1"; then echo "$usage"; return 0; fi
  if [ $# -ne 1 ]; then echo "$usage" >&2; return 1; fi

  if [ -z "$BWS_ACCESS_TOKEN" ]; then
    bws-env || return 1
  fi

  local secret_key=$1
  local ids
  ids=$(bws secret list -o json | jq -r --arg key "$secret_key" \
    '.[] | select(.key == $key) | .id') || return 1

  if [ -z "$ids" ]; then
    echo "no secret found with key '$secret_key'" >&2
    return 1
  fi

  local -a id_list=("${(@f)ids}")
  if [ ${#id_list} -gt 1 ]; then
    echo "multiple secrets found with key '$secret_key'; delete by ID instead:" >&2
    printf '  %s\n' "${id_list[@]}" >&2
    return 1
  fi

  if ! read -q "?Delete secret '$secret_key' (${id_list[1]})? [y/N] "; then
    echo >&2
    return 1
  fi
  echo >&2

  bws secret delete "${id_list[1]}"
}

# Reload DNS on router + edge and flush the local macOS cache.
flush-dns() {
  if _is_help "$1"; then
    echo "Usage: ${funcstack[1]}"
    echo "Reload unbound on 'router', reload pihole on 'edge', and flush the"
    echo "local macOS DNS cache (requires sudo)."
    return 0
  fi

  echo "Reloading unbound on router..." >&2
  ssh router unbound-control reload || echo "warn: unbound reload failed" >&2

  echo "Reloading pihole on edge..." >&2
  ssh edge podman exec systemd-pihole pihole reloaddns || echo "warn: pihole reload failed" >&2

  echo "Flushing local DNS cache..." >&2
  sudo dscacheutil -flushcache
  sudo killall -HUP mDNSResponder
}

# Copy your SSH public key to the clipboard and print it.
pubkey() {
  if _is_help "$1"; then
    echo "Usage: ${funcstack[1]}"
    echo "Copy your SSH public key (ed25519, falling back to rsa) to the"
    echo "clipboard and print it to stdout."
    return 0
  fi

  local key
  for key in ~/.ssh/id_ed25519.pub ~/.ssh/id_rsa.pub; do
    [ -f "$key" ] && break
  done
  if [ ! -f "$key" ]; then
    echo "no public key found in ~/.ssh" >&2
    return 1
  fi

  if [ "$(uname)" = "Darwin" ]; then
    pbcopy < "$key"
  else
    xclip -selection clipboard < "$key"
  fi

  cat "$key"
}

# Generate a random passphrase, GPG-encrypted to a file.
vault-passphrase() {
  if _is_help "$1"; then
    echo "Usage: ${funcstack[1]}"
    echo "Generate a 200-char random passphrase and GPG-encrypt it to"
    echo "vault_passphrase.gpg in the current directory."
    return 0
  fi

  pwgen --capitalize --numerals --secure 200 1 | head -n1 | gpg --armor --recipient jaredhocutt@gmail.com --encrypt --output vault_passphrase.gpg
}

# Decrypt vault_passphrase.gpg to stdout.
vault-passphrase-decrypt() {
  if _is_help "$1"; then
    echo "Usage: ${funcstack[1]}"
    echo "Decrypt vault_passphrase.gpg (in the current directory) to stdout."
    return 0
  fi

  gpg --batch --use-agent --decrypt vault_passphrase.gpg
}

# Convert a video to an animated GIF.
video2gif() {
  local usage="Usage: ${funcstack[1]} INPUT FPS SCALE OUTPUT
Convert INPUT to an animated GIF at the given FPS and SCALE (width in px,
height auto). Example: ${funcstack[1]} clip.mp4 15 480 clip.gif"
  if _is_help "$1"; then echo "$usage"; return 0; fi
  if [ $# -ne 4 ]; then echo "$usage" >&2; return 1; fi

  ffmpeg -i "$1" -vf "fps=$2,scale=$3:-1:flags=lanczos,split[s0][s1];[s0]palettegen[p];[s1][p]paletteuse" -loop 0 "$4"
}

# Losslessly cut a clip from a video by start/end time.
episode-split() {
  local usage="Usage: ${funcstack[1]} INPUT START END OUTPUT
Copy (no re-encode) the segment of INPUT between START and END into OUTPUT.
Times accept HH:MM:SS or seconds. Example: ${funcstack[1]} in.mkv 00:01:30 00:02:45 out.mkv"
  if _is_help "$1"; then echo "$usage"; return 0; fi
  if [ $# -ne 4 ]; then echo "$usage" >&2; return 1; fi

  ffmpeg -i "$1" -vcodec copy -acodec copy -ss "$2" -to "$3" "$4"
}