save-secret

#!/usr/bin/env bash

set -eEuo pipefail

function secret_exists() {
    local secret_name="${1?You must pass in a secret name to find_secret}"
    security find-generic-password -s "$secret_name" -a "$(whoami)" -w &>/dev/null
}

function save_secret() {
    local secret_name="${1?You must pass in a secret name to find_secret}"
    local secret_value="${2:-}"
    local args=(
        add-generic-password
        -s "$secret_name" # 'service name' will be used to access the secret later
        -a "$(whoami)"    # Account to associate with the secret
        -U                # Update item if it already exists
        -w                # Enter the password as a string
    )
    # If the secret value is defined, we'll just pass it in directly
    if [[ $secret_value != "" ]]; then
        args+=("$secret_value")
    fi
    security "${args[@]}"
}

function main() {
    local secret_name="${1?You must pass in a secret name to $0}"
    local secret_value="${2:-}"

    if secret_exists "$secret_name"; then
        replace_option="Replace secret"
        quit_option="Quit/Exit"
        options=(
            "$quit_option"
            "$replace_option"
        )
        choice=$(printf "%s\n" "${options[@]}" | fzf --header "Secret '$secret_name' already exists!")

        if [[ $choice == $quit_option ]]; then
            echo >&2 "Not going to update secret"
            exit 1
        fi
    fi

    if [[ $secret_value == "" ]]; then
        generate_option="Generate a secret for me"
        manual_option="Enter a secret manually"

        options=(
            "$generate_option"
            "$manual_option"
        )

        choice=$(printf "%s\n" "${options[@]}" | fzf)

        if [[ $choice == $generate_option ]]; then
            secret_value=$(openssl rand 5000 | gtr -d -c 'a-zA-Z0-9,./@!' | head -c 48)
        fi
    fi

    save_secret "$secret_name" "$secret_value"
}

main "${@}"