From 4bfff4b7e973d4affa23f3118b12889ea8ba32e9 Mon Sep 17 00:00:00 2001
From: Mo Tarbin <mhed.t91@gmail.com>
Date: Tue, 14 Jul 2026 11:57:29 -0400
Subject: [PATCH] Add script to handle secrets fetching

---
 scripts/pull-secrets.sh | 71 +++++++++++++++++++++++++++++++++++++++++
 scripts/push-secrets.sh | 69 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 140 insertions(+)
 create mode 100755 scripts/pull-secrets.sh
 create mode 100755 scripts/push-secrets.sh

diff --git a/scripts/pull-secrets.sh b/scripts/pull-secrets.sh
new file mode 100755
index 0000000..d0fee1f
--- /dev/null
+++ b/scripts/pull-secrets.sh
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+BW_SERVER="${BW_SERVER:-https://bitwarden.com}"
+
+# ── Auth ──────────────────────────────────────────────────────────────────────
+echo "→ Connecting to Vaultwarden at $BW_SERVER"
+CURRENT_SERVER=$(bw status | jq -r '.serverUrl // empty')
+
+if [ "$CURRENT_SERVER" != "$BW_SERVER" ]; then
+  bw logout || true
+  bw config server "$BW_SERVER"
+fi
+
+if [ -z "${BW_SESSION:-}" ]; then
+  BW_LOGIN_STATUS=$(bw status | jq -r '.status')
+
+  if [ "$BW_LOGIN_STATUS" = "unauthenticated" ]; then
+    if [ -n "${BW_CLIENTID:-}" ] && [ -n "${BW_CLIENTSECRET:-}" ]; then
+      bw login --apikey
+    else
+      bw login
+    fi
+  fi
+
+  export BW_SESSION=$(bw unlock --passwordenv BW_PASSWORD --raw)
+fi
+
+bw sync --session "$BW_SESSION" > /dev/null
+
+# ── Helper ────────────────────────────────────────────────────────────────────
+get_note() {
+  bw get item "$1" --session "$BW_SESSION" | jq -r '.notes'
+}
+
+get_password() {
+  bw get item "$1" --session "$BW_SESSION" | jq -r '.login.password // .notes'
+}
+
+# ── Android ───────────────────────────────────────────────────────────────────
+echo "→ Writing android/app/google-services.json"
+get_note "Donetick Google Services Android" > "$REPO_ROOT/android/app/google-services.json"
+
+echo "→ Writing android keystore"
+get_note "Donetick Android Keystore" | base64 --decode > "$REPO_ROOT/android/app/release/donetick.jks"
+
+KEYSTORE_PASSWORD=$(get_password "Donetick Keystore Password")
+
+cat > "$REPO_ROOT/android/keystore.properties" <<EOF
+storeFile=release/donetick.jks
+storePassword=$KEYSTORE_PASSWORD
+keyAlias=key0
+keyPassword=$KEYSTORE_PASSWORD
+EOF
+
+echo "→ Writing android/play-service-account.json"
+get_note "Donetick Google Play Service Account" > "$REPO_ROOT/android/play-service-account.json"
+
+# ── iOS ───────────────────────────────────────────────────────────────────────
+echo "→ Writing ios/App/App/GoogleService-Info.plist"
+get_note "Donetick Google Services iOS" > "$REPO_ROOT/ios/App/App/GoogleService-Info.plist"
+
+echo "→ Writing App Store Connect key"
+get_note "Donetick App Store Connect Key" | base64 --decode > "$REPO_ROOT/ios/AuthKey_84F695CDQ3.p8"
+
+# ── Env ───────────────────────────────────────────────────────────────────────
+echo "→ Writing .env.production"
+get_note "Donetick Env Production" > "$REPO_ROOT/.env.production"
+
+echo "✓ All secrets pulled successfully"
diff --git a/scripts/push-secrets.sh b/scripts/push-secrets.sh
new file mode 100755
index 0000000..5b496ee
--- /dev/null
+++ b/scripts/push-secrets.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# One-time script to upload local secrets into Vaultwarden.
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# BW_SERVER="${BW_SERVER:-https://www.bitwareden.com}"
+
+# ── Auth ──────────────────────────────────────────────────────────────────────
+# bw config server "$BW_SERVER"
+# bw login
+export BW_SESSION=$(bw unlock --passwordenv BW_PASSWORD --raw)
+
+# ── Helper ────────────────────────────────────────────────────────────────────
+upsert_secure_note() {
+  local name="$1"
+  local content="$2"
+  local existing_id
+  existing_id=$(bw list items --session "$BW_SESSION" | jq -r --arg n "$name" '.[] | select(.name == $n) | .id' | head -1)
+
+  if [[ -n "$existing_id" ]]; then
+    bw get item "$existing_id" --session "$BW_SESSION" \
+      | jq --arg c "$content" '.notes = $c' \
+      | bw encode \
+      | bw edit item "$existing_id" --session "$BW_SESSION" > /dev/null
+    echo "  ✓ Updated: $name"
+  else
+    bw get template item --session "$BW_SESSION" \
+      | jq --arg n "$name" --arg c "$content" \
+        '.name = $n | .type = 2 | .secureNote = {"type":0} | .notes = $c' \
+      | bw encode \
+      | bw create item --session "$BW_SESSION" > /dev/null
+    echo "  ✓ Created: $name"
+  fi
+}
+
+# ── Upload ────────────────────────────────────────────────────────────────────
+echo "→ Uploading Android google-services.json"
+upsert_secure_note \
+  "Donetick Google Services Android" \
+  "$(cat "$REPO_ROOT/android/app/google-services.json")"
+
+echo "→ Uploading Fastline google-services.json"
+upsert_secure_note \
+  "Donetick Google Play Service Account" \
+  "$(cat "$REPO_ROOT/donetick-5f910-5688a280a65a--fastline.json")"
+
+echo "→ Uploading Android keystore (base64)"
+upsert_secure_note \
+  "Donetick Android Keystore" \
+  "$(base64 < /Users/mohamad-macbook-air/donetick-android-ley)"
+
+echo "→ Uploading iOS GoogleService-Info.plist"
+upsert_secure_note \
+  "Donetick Google Services iOS" \
+  "$(cat "$REPO_ROOT/ios/App/App/GoogleService-Info.plist")"
+
+echo "→ Uploading App Store Connect key (base64)"
+upsert_secure_note \
+  "Donetick App Store Connect Key" \
+  "$(base64 < /Users/mohamad-macbook-air/Downloads/AuthKey_84F695CDQ3.p8)"
+
+echo "→ Uploading .env.production"
+upsert_secure_note \
+  "Donetick Env Production" \
+  "$(cat "$REPO_ROOT/.env.production")"
+
+echo ""
+echo "✓ All secrets uploaded. Verify in Vaultwarden, then you can safely delete local copies outside the repo."
+echo "  NOTE: 'Donetick Keystore Password' should already exist — if not, create it manually as a Login item."