#!/usr/bin/env bash

# Move the personal environment file out of the checkout.
#
# config/bash/env holds API keys and tokens, and it lived inside the working
# tree that agents, backup tools and `panama update`'s diff walk routinely --
# world-readable by default, one careless `git add -f` away from a remote.
# Its home is now ~/.config/panama/env, owner-only, which .bashrc sources
# with a permission check. The repo path keeps working unmigrated (the glob
# in .bashrc still sources it), so this move can safely run at any login.

set -euo pipefail

PANAMA_PATH="${PANAMA_PATH:-$HOME/.local/share/Panama}"
old="$PANAMA_PATH/config/bash/env"
new="${XDG_CONFIG_HOME:-$HOME/.config}/panama/env"

[[ -f "$old" ]] || exit 0

if [[ -f "$new" ]]; then
    # Both exist: the person already started one at the new home. Refusing to
    # merge secrets automatically is the safe answer; say what is where.
    chmod 600 "$old" "$new"
    echo "Both $old and $new exist; not merging them automatically."
    echo "Move what you still need into $new and delete the old file."
    exit 0
fi

mkdir -p "$(dirname "$new")"
mv "$old" "$new"
chmod 600 "$new"
echo "Moved the personal environment to $new (owner-only)."