[CmdletBinding()]
param(
    [string]$Destination = (Join-Path $PSScriptRoot "..\.local\secrets")
)

$ErrorActionPreference = "Stop"
$secretNames = @(
    "grafana_admin_password",
    "grafana_database_password",
    "postgres_admin_password"
)

$resolvedDestination = [System.IO.Path]::GetFullPath($Destination)
[System.IO.Directory]::CreateDirectory($resolvedDestination) | Out-Null

foreach ($secretName in $secretNames) {
    $secretPath = Join-Path $resolvedDestination $secretName

    if (Test-Path -LiteralPath $secretPath) {
        Write-Host "Keeping existing secret: $secretName"
        continue
    }

    $bytes = New-Object byte[] 32
    $generator = [System.Security.Cryptography.RandomNumberGenerator]::Create()
    try {
        $generator.GetBytes($bytes)
    }
    finally {
        $generator.Dispose()
    }

    $value = [Convert]::ToBase64String($bytes)
    [System.IO.File]::WriteAllText($secretPath, $value, [System.Text.UTF8Encoding]::new($false))
    Write-Host "Created secret: $secretName"
}

Write-Host "Local secrets are ready in $resolvedDestination"