# if ! sha256sum=$(command -v sha256sum) >/dev/null; then
#   echo "$0 requires sha256sum" >&2
#   false
# fi

if ! sha256sum=$(command -v sha256sum) >/dev/null; then
  echo "$0 requires sha256sum" >&2
  false
fi

# decrypt() {
#   path=$1
#   $gpg --decrypt .encrypt.d/master_key.gpg |
#     $gpg --batch --output - --pinentry-mode loopback --passphrase-fd 0 \
#       --decrypt "$path"
# }

decrypt() {
  path=$1
  $gpg --decrypt .encrypt.d/master_key.gpg |
    $gpg --batch --output - --passphrase-fd 0 \
      --decrypt "$path"
}

rules=$(cat .encrypt)

# shellcheck disable=SC2086
secrets_in_worktree=$(find $(cat .encrypt) -type f)

# shellcheck disable=SC2046
worktree_glob=$(find $(cat .encrypt) -type f -not -name '*.gpg')
: "↓debug worktree_glob↓
$worktree_glob"

: "↓debug secrets_in_worktree↓
$secrets_in_worktree"

secrets_in_tracked=$(printf '%s\n' $secrets_in_worktree $(pijul list) | sort | uniq -d)

# shellcheck disable=SC2086
# shellcheck disable=SC2046
tracked_glob=$(printf '%s\n' $worktree_glob $(pijul list) | sort | uniq -d)
: "↓debug tracked_glob↓
$tracked_glob"

: "↓debug secrets_in_tracked↓
$secrets_in_tracked"

# shellcheck disable=SC2086
pijul remove $tracked_glob # 秘密のファイルはさっさと記録から除外

# .encryptにマッチするパスをremoveして`.gpg`をつけてaddし直す
for path in $secrets_in_tracked; do

# pijulが記録しているパスのうち`*.gpg`にマッチするもの (pijul listが変わってるのでtracked_globとは重複しない)
gpg_tracked=$(pijul list | grep '\.gpg$' | sed 's/\.gpg$//')
: "↓debug gpg_tracked↓
$gpg_tracked"

  case $path in
  *.gpg)
    break
    ;;
  *)
    pijul remove "$path" # 秘密のファイルはrecordしてはいけない
    touch "$path.gpg"

# 秘密にしなければいけないファイルたち
will_be_encrypted="$tracked_glob
$gpg_tracked"
# 秘密のファイルに変更があれば暗号化し直す
for path in $will_be_encrypted; do
  if [ ! -f "$path" ]; then
    [ "$path" = ".encrypt.d/master_key" ] || pijul remove "$path.gpg"
  else
    if [ -f "$path.gpg" ] &&
      [ "$($sha256sum <"$path")" != "$(decrypt "$path.gpg" | $sha256sum)" ]; then
      rm "$path.gpg"
    fi
    if [ ! -e "$path.gpg" ]; then
      encrypt "$path"
    fi

    ;;
  esac

  fi

# # `.gpg`で終わるファイルを更新
# for path in $(pijul list); do
#   case $path in
#   .encrypt.d/master_key.gpg) ;;
#   *.gpg)
#     if [ -f "$path" ]; then
#       rm "$path"
#     fi
#     encrypt "${path%%.gpg}"
#     ;;
#   esac
# done