#!/bin/bash
# Copyright 2026 Umbra Tools (umbratools.com)
# SPDX-License-Identifier: Apache-2.0

# Vaultwarden JSON Export Script
# This script exports a user's vault to JSON format using the Bitwarden CLI.
# 
# IMPORTANT: This requires the user's MASTER PASSWORD to decrypt the vault data.
# The SQLite database stores data ENCRYPTED - it cannot be converted to JSON without
# the master password.
#
# The JSON export is useful for:
# - Migrating to a different password manager
# - Importing into a different Vaultwarden instance as a different user
# - Human-readable backup (store securely!)
#
# For full instance disaster recovery, use restore-sqlite.sh instead.
#
# Usage: ./export-to-json.sh <email> [output-file.json]
# Example: ./export-to-json.sh user@example.com my-vault-export.json
#
# The master password can be provided via:
# - BW_MASTER_PASSWORD environment variable
# - Interactive prompt (recommended for security)

set -euo pipefail

EMAIL="${1:-}"
OUTPUT_FILE="${2:-vaultwarden-export-$(date +%Y-%m-%d).json}"
VAULTWARDEN_URL="https://vault.bdmurphy.me"

if [ -z "$EMAIL" ]; then
    echo "Usage: $0 <email> [output-file.json]"
    exit 1
fi

# Check if bw CLI is available
if ! command -v bw &> /dev/null; then
    echo "ERROR: Bitwarden CLI (bw) not found. Install with: npm install -g @bitwarden/cli"
    exit 1
fi

# Configure server URL
bw config server "$VAULTWARDEN_URL" >/dev/null

# Login
echo "Logging in to Vaultwarden as $EMAIL..."

if [ -n "${BW_MASTER_PASSWORD:-}" ]; then
    # Use environment variable
    export BW_SESSION=$(bw login "$EMAIL" "$BW_MASTER_PASSWORD" --raw)
else
    # Interactive login
    export BW_SESSION=$(bw login "$EMAIL" --raw)
fi

if [ -z "$BW_SESSION" ] || [ "$BW_SESSION" = "null" ]; then
    echo "ERROR: Login failed. Check credentials."
    exit 1
fi

echo "Login successful. Exporting vault..."

# Export vault to JSON
bw export --format json --output "$OUTPUT_FILE" --session "$BW_SESSION"

# Lock the vault
bw lock --session "$BW_SESSION" >/dev/null

echo "Export complete: $OUTPUT_FILE"
echo ""
echo "IMPORTANT: This file contains DECRYPTED vault data. Store it securely!"
echo "To import into another Vaultwarden instance:"
echo "  1. Log in to the target Vaultwarden web vault"
echo "  2. Go to Tools > Import Data"
echo "  3. Select 'Bitwarden (json)' as format"
echo "  4. Upload this file"