scripts/update-env-from-secrets.sh

#!/usr/bin/env bash
set -uo pipefail

ENV_FILE="/etc/profile.d/openclaw-env.sh"
LOG_FILE="/var/log/openclaw/env-update.log"
CACHE_FILE="/tmp/hf-env-cache.json"
EXPORT_FILE="/tmp/env-from-api.sh"

DRY_RUN=false

usage() {
    cat <<EOF
Usage: $0 [OPTIONS]

从 Hugging Face API 获取最新的环境变量并更新到本地文件。

必需的环境变量：
  HF_TOKEN 或 HF_API_TOKEN    HuggingFace API Token
  OPENCLAW_HF_SPACE_ID              HuggingFace Space ID

选项：
  --dry-run    预览将从 API 获取的环境变量，不写入任何文件
  -h, --help   显示本帮助信息

使用示例：
  # 预览模式（不写入文件）
  HF_TOKEN=hf_xxxxx OPENCLAW_HF_SPACE_ID=username/space-name $0 --dry-run

  # 正常执行
  HF_TOKEN=hf_xxxxx OPENCLAW_HF_SPACE_ID=username/space-name $0

  # 使用 HF_API_TOKEN
  HF_API_TOKEN=hf_xxxxx OPENCLAW_HF_SPACE_ID=username/space-name $0

EOF
}

while [[ $# -gt 0 ]]; do
    case "$1" in
        --dry-run)
            DRY_RUN=true
            shift
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        *)
            echo "Unknown option: $1"
            usage
            exit 1
            ;;
    esac
done

mkdir -p /var/log/openclaw

log() {
    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $1" | tee -a "$LOG_FILE"
}

log_dry() {
    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [DRY-RUN] $1"
}

fetch_and_show_env() {
    local OPENCLAW_HF_SPACE_ID="$1"
    local api_token="$2"

    if [[ -z "$OPENCLAW_HF_SPACE_ID" ]] || [[ -z "$api_token" ]]; then
        log "Error: OPENCLAW_HF_SPACE_ID or API_TOKEN is empty"
        return 1
    fi

    log "Fetching environment variables from HF API for space: $OPENCLAW_HF_SPACE_ID"

    local response
    response=$(curl -s -w "\n%{http_code}" \
        -H "Authorization: Bearer $api_token" \
        "https://huggingface.co/api/spaces/$OPENCLAW_HF_SPACE_ID/runtime" 2>/dev/null)

    local http_code=$(echo "$response" | tail -n1)
    local body=$(echo "$response" | sed '$d')

    if [[ "$http_code" != "200" ]]; then
        log "Error: API request failed with HTTP $http_code"
        log "Response: $body"
        return 1
    fi

    echo "$body" > "$CACHE_FILE"

    if ! command -v jq >/dev/null 2>&1; then
        log "Error: jq not available, cannot parse API response"
        return 1
    fi

    local env_count
    env_count=$(echo "$body" | jq '.env // {} | length')
    if [[ "$env_count" -eq 0 ]]; then
        log "Warning: API response contains no environment variables"
        return 1
    fi

    log "Found $env_count environment variables from API"
    echo ""

    if [[ "$DRY_RUN" == "true" ]]; then
        log_dry "========== DRY-RUN: Environment Variables to be fetched =========="
    else
        : > "$EXPORT_FILE"
    fi

    local sensitive_pattern="(TOKEN|KEY|SECRET|PASSWORD|ENCRYPTION_PASSWORD)"
    while IFS='=' read -r key value; do
        if [[ -n "$key" && "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
            if [[ "$DRY_RUN" == "true" ]]; then
                if [[ "$key" =~ $sensitive_pattern ]]; then
                    log_dry "  $key=<sensitive>"
                else
                    log_dry "  $key=$value"
                fi
            else
                printf 'export %s=%q\n' "$key" "$value" >> "$EXPORT_FILE"
                if [[ "$key" =~ $sensitive_pattern ]]; then
                    log "Exported: $key=<sensitive>"
                else
                    log "Exported: $key=$value"
                fi
            fi
        fi
    done < <(echo "$body" | jq -r '.env // {} | to_entries[] | "\(.key)=\(.value)"')

    if [[ "$DRY_RUN" == "true" ]]; then
        log_dry "========== DRY-RUN: Would write to files =========="
        log_dry "  ENV_FILE=$ENV_FILE (skipped in dry-run)"
        log_dry "  EXPORT_FILE=$EXPORT_FILE (skipped in dry-run)"
        log_dry "========================================================"
        rm -f "$CACHE_FILE"
    fi

    return 0
}

main() {
    log "Starting environment update from HF API..."
    if [[ "$DRY_RUN" == "true" ]]; then
        log "*** DRY-RUN MODE: No files will be written ***"
    fi

    local OPENCLAW_HF_SPACE_ID="${OPENCLAW_HF_SPACE_ID:-}"
    if [[ -z "$OPENCLAW_HF_SPACE_ID" ]]; then
        log "Error: OPENCLAW_HF_SPACE_ID is required but not set"
        log "Please set OPENCLAW_HF_SPACE_ID environment variable"
        exit 1
    fi

    local hf_token="${HF_TOKEN:-${HF_API_TOKEN:-}}"
    if [[ -z "$hf_token" ]]; then
        log "Error: HF_TOKEN is required but not set"
        log "Please set HF_TOKEN or HF_API_TOKEN environment variable"
        exit 1
    fi

    if ! fetch_and_show_env "$OPENCLAW_HF_SPACE_ID" "$hf_token"; then
        log "Warning: Failed to fetch env from API"
        exit 1
    fi

    if [[ "$DRY_RUN" == "true" ]]; then
        log "Dry-run completed. No files were modified."
        exit 0
    fi

    if [[ -x /usr/local/bin/save-env.sh ]]; then
        if [[ -f "$EXPORT_FILE" && -s "$EXPORT_FILE" ]]; then
            log "Sourcing API exports before calling save-env.sh"
            source "$EXPORT_FILE"
        fi
        /usr/local/bin/save-env.sh
        log "Environment file updated successfully"
    else
        log "Error: save-env.sh not found or not executable"
        exit 1
    fi

    rm -f "$EXPORT_FILE"

    log "Current non-sensitive variables:"
    log "  OPENCLAW_BACKUP_DATASET_REPO: ${OPENCLAW_BACKUP_DATASET_REPO:-<not set>}"
    log "  OPENCLAW_BACKUP_CRON: ${OPENCLAW_BACKUP_CRON:-*/12 * * * *}"
    log "  OPENCLAW_BACKUP_ENCRYPTION_ENABLED: ${OPENCLAW_BACKUP_ENCRYPTION_ENABLED:-<not set>}"
}

main "$@" 2>&1 | tee -a "$LOG_FILE"