psql-store-credential

#!/bin/sh
set -e
set -u

fn_help() { (
    echo "psql-store-credential v1.0.0 - stores a credential in ~/.pgpass"
    echo ""
    echo "USAGE"
    echo "    [space] pg-addpass [pg-url]"
    echo ""
    echo "EXAMPLES"
    echo "    Prompt for PG_URL string"
    echo "        pg-addpass"
    echo "    Prefix with space and give PG_URL string"
    echo "          pg-addpass 'postgress://user:pass@host:port/db?sslmode=verify-full'"
    echo "    Parse PG_URL from .env file"
    echo "        cat .env | grep PG_URL | cut -d'=' -f2- | pg-addpass"
    echo ""
    echo "NOTES"
    echo "    - query parameters will be *ignored* (ex: ?sslmode=)"
    echo "    - passwords with ':' or '@' will not be parsed correctly"
    echo "      (you may be able to enter them into ~/.pgpass manually)"
    echo ""
    echo "WARNING"
    echo "    remember to clear this command from your shell history if"
    echo "    you don't want the password to be saved there"
    echo "    (some shells omit commands if you prefix them with a space)"
    echo ""
    echo "COPYING"
    echo "    Copyright (c) 2024 AJ ONeal <aj@bnna.net>"
    echo "    Licensed under the MPL-2.0"
); }

fn_init_pgpass() { (
    if ! test -e ~/.pgpass; then
        touch ~/.pgpass
    fi
    if ! grep -q -i '^\s*#.*port:d' ~/.pgpass; then
        echo '# hostname:port:database:username:password' >> ~/.pgpass.header.txt
        mv ~/.pgpass ~/.pgpass.noheader.bak
        cat ~/.pgpass.header.txt ~/.pgpass.noheader.bak > ~/.pgpass
        rm ~/.pgpass.header.txt ~/.pgpass.noheader.bak
    fi
    if ! grep -q '^\s*#\s*export\s\+PGPASSFILE=' ~/.pgpass; then
        echo "# export PGPASSFILE='${HOME}/.pgpass'" >> ~/.pgpass.header.txt
        mv ~/.pgpass ~/.pgpass.noheader.bak
        cat ~/.pgpass.header.txt ~/.pgpass.noheader.bak > ~/.pgpass
        rm ~/.pgpass.header.txt ~/.pgpass.noheader.bak
    fi
    chmod 0600 ~/.pgpass
); }

fn_add_pgpass() { (
    b_url="${1}"

    if echo "${b_url}" | grep -q -v '?'; then
        b_url="${b_url}?"
    fi
    b_params="$(echo "${b_url}" | cut -d'@' -f2 | cut -d'?' -f2-)"
    b_host_port="$(echo "${b_url}" | cut -d'@' -f2 | cut -d'/' -f1)"
    b_host="$(echo "${b_host_port}" | cut -d':' -f1)"
    b_db="$(echo "${b_url}" | rev | cut -d'/' -f1 | rev | cut -d'?' -f1)"
    b_user_pass="$(echo "${b_url}" | cut -d'@' -f1 | sed 's;://;:;g' | cut -d':' -f2-)"
    b_user="$(echo "${b_user_pass}" | cut -d':' -f1)"
    b_pass="$(echo "${b_user_pass}" | cut -d':' -f2-)"
    b_mask="$(printf '%s' "${b_pass}" | tr '[:graph:]' '*')" # omit newline

    if grep -q -F "${b_host_port}:${b_db}:${b_user_pass}" ~/.pgpass; then
        echo "'${b_host_port}:${b_db}:${b_user}:${b_mask}' found in ~/.pgpass"
        return 0
    fi

    if grep -q -F "${b_host_port}:${b_db}:${b_user}:" ~/.pgpass; then
        echo "${b_host_port}:${b_db}:${b_user} already exists in ~/.pgpass"
        {
            echo ""
            echo "    PLEASE UPDATE PASSWORD MANUALLY"
            echo ""
        } >&2
        return 1
    fi

    {
        echo ""
        echo "Saved to ~/.pgpass:"
    } >&2
    echo "${b_host_port}:${b_db}:${b_user_pass}" >> ~/.pgpass
    echo "${b_host_port}:${b_db}:${b_user}:${b_mask}"

    if ! grep -q -F "*:*:${b_db}:${b_user}:" ~/.pgpass; then
        echo "*:*:${b_db}:${b_user_pass}" >> ~/.pgpass
        echo "*:*:${b_db}:${b_user}:${b_mask}"
    fi

    {
        echo ""
        echo "The password will be matched by host (or localhost), dbname, and username"
    } >&2
    echo "    psql --host ${b_host} --dbname ${b_db} --username ${b_user}"
    echo "    psql 'postgres://${b_user}@${b_host}/${b_db}?${b_params}'"
); }

main() { (
    b_url=""

    case ${1:-} in
        --help | help)
            fn_help
            return 0
            ;;
        -V | --version | version)
            fn_help
            return 0
            ;;
        "")
            echo 'Example: postgres://user:pass@host:port/db?params'
            printf 'PG_URL: '
            read -r b_url
            ;;
        *)
            b_url="${1}"
            ;;
    esac

    if test -z "${b_url}"; then
        echo "error: no url provided and failed to read url from tty" >&2
        return 1
    fi

    fn_init_pgpass
    fn_add_pgpass "${b_url}" >&2
); }

main "${@}"