#!/bin/bash
set -o pipefail
MODE="$1"
PROVISIONER="$2"

case $MODE in
  check)
    step ca provisioner list | jq -r '.[] | select(.name == "'${PROVISIONER}'").encryptedKey' |  step crypto jwe decrypt --password-file=/etc/step-ca/new_password.txt  > /dev/null 
  ;;
  change)
    ENCRYPTED_KEY=$(step ca provisioner list | jq -r '.[] | select(.name == "'${PROVISIONER}'").encryptedKey' | \
    step crypto jwe decrypt --password-file=/etc/step-ca/password.txt | \
    step crypto jwe encrypt --password-file=/etc/step-ca/new_password.txt --alg PBES2-HS256+A128KW | \
    step crypto jose format)
    step ca provisioner update "${PROVISIONER}" --private-key=<(echo -n "$ENCRYPTED_KEY")
  ;;
  *)
    echo "$0 [change|check] provisioner"
  ;;
esac
