# Shared shell step for a systemd oneshot that lands a freshly-fetched
# secret on disk: never `> path` the live file directly, because a reader
# racing the write can open it between the truncate and the write, or
# between the write and a `chmod` that follows it, and see an empty file
# or one at the wrong mode. `mktemp` always creates its file at 0600
# regardless of umask, so the temp file is private for its whole life; only
# the `chmod`/`chown`/`mv -f` sequence below ever makes the target mode and
# owner visible, and only once the content is already final.
#
# Pure function — NOT a NixOS module. Call it from a module's `let`:
#
#   atomicWriteSecret = import ./lib/atomic-write-secret.nix { };
#   ...
#   script = ''
#     ${atomicWriteSecret}
#     printf '%s\n' "$secret" | atomic_write_secret 0600 "" "$path"
#     printf '%s\n' "$secret" | atomic_write_secret 0400 "grafana:0" "$path"
#   '';
#
# Third argument to `atomic_write_secret` is the target path; the second is
# an owner for `chown` (`user:group` or a bare uid), or "" to leave the
# mktemp-created root:root ownership as it is. Reads its content from
# stdin. Requires `coreutils` on the caller's `path`.
{ }:
''
  atomic_write_secret() {
    local mode="$1" owner="$2" target="$3" tmp
    tmp="$(mktemp "$(dirname -- "$target")/.$(basename -- "$target").XXXXXX")"
    # The write happens in a subshell so its own EXIT trap cleans up `$tmp`
    # on failure (a `RETURN` trap does not fire when `set -e` aborts the
    # function mid-body) without touching an EXIT trap the calling script's
    # own `script` may already have — subshell traps are local to the
    # subshell. A named handler, not an inline trap string, so `local rc=$?`
    # is a normal function-local assignment shellcheck can see: it only
    # removes `$tmp` when `$?` is nonzero — on the ordinary path the
    # subshell also exits successfully, and `$tmp` has to survive that to
    # reach the `mv` below.
    (
      _atomic_write_secret_cleanup() {
        local rc=$?
        [ "$rc" -eq 0 ] || rm -f "$tmp"
        exit "$rc"
      }
      trap _atomic_write_secret_cleanup EXIT
      cat > "$tmp"
      chmod "$mode" "$tmp"
      if [ -n "$owner" ]; then
        chown "$owner" "$tmp"
      fi
    )
    mv -f "$tmp" "$target"
  }
''