#!/usr/bin/env bash
# Portable sanitizer: emit safe export lines using bash only (no awk/sed)
set -euo pipefail
IFS=$'\n\t'
ENV_DIR="$(cd "$(dirname "$0")/../env" && pwd)"
[ -d "$ENV_DIR" ] || exit 0

for f in "$ENV_DIR"/*.env; do
  [ -e "$f" ] || continue
  while IFS= read -r rawline || [ -n "$rawline" ]; do
    # ignore comments/blank
    if [[ $rawline =~ ^[[:space:]]*# ]]; then continue; fi
    if [[ $rawline =~ ^[[:space:]]*$ ]]; then continue; fi

    # allow leading whitespace; match assignment
    if [[ $rawline =~ ^[[:space:]]*export[[:space:]]+([A-Za-z_][A-Za-z0-9_]*)=(.*)$ ]]; then
      var="${BASH_REMATCH[1]}"
      val="${BASH_REMATCH[2]}"
    elif [[ $rawline =~ ^[[:space:]]*([A-Za-z_][A-Za-z0-9_]*)=(.*)$ ]]; then
      var="${BASH_REMATCH[1]}"
      val="${BASH_REMATCH[2]}"
    else
      printf "## REJECTED %s: not an assignment: %s\n" "$f" "$rawline"
      continue
    fi

    # strip surrounding quotes if present
    if [[ $val =~ ^\"(.*)\"$ ]]; then val="${BASH_REMATCH[1]}"; fi
    if [[ $val =~ ^\'(.*)\'$ ]]; then val="${BASH_REMATCH[1]}"; fi

    # reject suspicious characters that could allow code execution
    if [[ $val =~ [\`\$\(\)\;\&\|\>\<] ]]; then
      printf "## REJECTED %s: unsafe characters in value for %s\n" "$f" "$var"
      continue
    fi

    # Escape value for safe eval using printf %q (bash-specific but works in our environment)
    printf -v esc_val '%q' "$val"

    # Output export line ready for eval
    printf "export %s=%s\n" "$var" "$esc_val"
  done < "$f"
done