vaultik/internal/cli/config.go

package cli

import (
	"bytes"
	"errors"
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"reflect"
	"slices"
	"strconv"
	"strings"
	"unicode/utf8"

	"github.com/spf13/cobra"
	"gopkg.in/yaml.v3"
	"sneak.berlin/go/vaultik/internal/config"
	"sneak.berlin/go/vaultik/internal/ui"
)

// configFileMode is the permission set for freshly written config files;
// configs may hold S3 credentials, so keep them owner-only.
const configFileMode = 0o600

// configSetArgs is the argument count of `config set <key> <value>`.
const configSetArgs = 2

// configDirMode is the permission set for created config directories;
// parent config dirs (e.g. ~/.config) are conventionally traversable.
const configDirMode = 0o755

// configYAMLIndent matches the 2-space indentation of defaultConfigTemplate,
// so `config set` writes the file back with the same indentation rather than
// yaml.Marshal's 4-space default.
const configYAMLIndent = 2

// yamlStringTag is YAML's tag for a string scalar.
const yamlStringTag = "!!str"

var (
	errConfigExists     = errors.New("config file already exists")
	errEmptyConfig      = errors.New("empty config file")
	errKeyNotFound      = errors.New("key not found")
	errNeedNumericIndex = errors.New("key is a list; use a numeric index")
	errIndexOutOfRange  = errors.New("index out of range")
	errNotMapOrList     = errors.New("key is not a map or list")
	errWouldNotLoad     = errors.New(
		"vaultik would not load the config after this change, " +
			"so the file was not changed")
)

const defaultConfigTemplate = `# vaultik configuration
# Documentation: https://sneak.berlin/go/vaultik

# ─── REQUIRED ────────────────────────────────────────────────────────────────

# Age recipient public keys for encryption. snapshot create needs at least
# one; listing, verifying and restoring do not, so a machine that only
# restores can leave this empty.
# Backups are encrypted to ALL listed recipients; any one of the corresponding
# private keys can decrypt. Adding a recipient later does not re-encrypt data
# already stored: deduplicated chunks and existing blobs stay encrypted to the
# earlier recipients, so a newly added key cannot restore them on its own (see
# docs/REPOSTRUCTURE.md, Accepted Risks). Generate a keypair and add its
# public key with:
#   age-keygen -o vaultik_backup_private_key.txt
#   grep 'public key' vaultik_backup_private_key.txt
#   vaultik config set age_recipients.0 age1...
age_recipients: []

# Named snapshots. Each snapshot backs up one or more paths and can have its
# own exclude patterns in addition to the global excludes below.
#
# Exclude pattern semantics:
#   - Patterns starting with / are anchored to the snapshot path root
#     (e.g. "/Library/Caches" matches only ~/Library/Caches in a ~ snapshot)
#   - Patterns without a leading / match anywhere in the tree
#     (e.g. ".cache" matches any directory named .cache at any depth)
#   - Globs are supported: *, **, ?
snapshots:
  home:
    paths:
      - "~"
    exclude:
      # Trash, temp, and filesystem metadata
      - "/.Trash"
      - "/.Trashes"
      - "/.fseventsd"
      - "/.Spotlight-V100"
      - "/.TemporaryItems"
      - "/tmp"
      - "/.rnd"
      - ".DS_Store"
      # Caches and package manager state (rebuildable)
      - ".cache"
      - ".bundle"
      - "/.cpan/build"
      - "/.cpan/sources"
      - "/.gradle/caches"
      - "/.dropbox"
      - "/.minikube/cache"
      - "/.local/share/containers/podman/machine"
      - "/.persepolis"
      - "/Library/Caches"
      - "/Library/Logs"
      - "/Library/Cookies"
      - "/Library/Metadata"
      - "/Library/Suggestions"
      - "/Library/PubSub"
      - "/Library/Homebrew"
      - "/Library/Developer"
      - "/Library/Google/GoogleSoftwareUpdate"
      - "/Library/Preferences/Macromedia/Flash Player"
      - "/Library/Preferences/SDMHelpData"
      - "/Library/VoiceTrigger/SAT"
      # Language/toolchain package caches (rebuildable from registries)
      - "/.npm"
      - "/.cargo/registry"
      - "/.cargo/git"
      - "/.rustup/toolchains"
      - "/go/pkg/mod"
      - "/.m2/repository"
      - "/.vagrant.d/boxes"
      - "node_modules"
      - "__pycache__"
      - ".venv"
      # Virtual machine disk images (huge; remove these lines to back them up)
      - "/Parallels"
      - "/Virtual Machines.localized"
      - "/VirtualBox VMs"
      - "/.orbstack"
      - "/Library/Containers/com.utmapp.UTM"
      # Downloaded LLM models (huge, re-downloadable)
      - "/.ollama/models"
      - "/.lmstudio/models"
      # Cloud-synced storage. These are synced to a provider already, and on
      # modern macOS may contain dataless placeholder files that the backup
      # would force-download in full.
      - "/Library/CloudStorage"
      - "/Library/Mobile Documents"
      # Android SDK and emulator images (re-downloadable)
      - "/Library/Android/sdk"
      - "/.android/avd"
      # Cloud-synced or restorable-from-server data
      - "/Library/Mail"
      - "/Library/Mail Downloads"
      - "/Library/Safari"
      - "/Library/Application Support/Evernote"
      - "/Library/Application Support/MobileSync"
      - "/Library/Application Support/SyncServices"
      - "/Library/Application Support/protonmail/bridge/cache"
      - "/Library/Application Support/Syncthing/index-*"
      - "/Library/Syncthing/folders"
      - "/Documents/Dropbox/.dropbox.cache"
      # Large rebuildable app data (games, media caches, device backups)
      - "/Applications/Fortnite"
      - "/Documents/Steam Content"
      - "/Library/Application Support/Ableton"
      - "/Library/Application Support/CrossOver Games"
      - "/Library/Application Support/SecondLife/cache"
      - "/Library/Application Support/Steam/SteamApps"
      - "/Library/Containers/com.docker.docker"
      - "/Library/Group Containers/group.com.apple.secure-control-center-preferences"
      - "/Library/iTunes/iPad Software Updates"
      - "/Library/iTunes/iPhone Software Updates"
      - "/Movies/CacheClip"
      - "/Movies/ProxyMedia"
      - "/Music/iTunes/Album Artwork"
      - "/Pictures/iPod Photo Cache"

  # Third-party applications. OS-provided apps live in /System/Applications
  # on modern macOS and are never in /Applications, but Apple-installed
  # App Store apps (Safari, GarageBand, iWork, iMovie) are excluded since
  # they are re-downloadable.
  apps:
    paths:
      - /Applications
    exclude:
      - ".DS_Store"
      - "/Safari.app"
      - "/GarageBand.app"
      - "/iMovie.app"
      - "/Keynote.app"
      - "/Numbers.app"
      - "/Pages.app"
      - "/Xcode.app"
      - "/Spotify.app"
      - "/Steam.app"
      - "/VirtualBox.app"
      - "/Utilities/Adobe Installers"

# Storage backend (pick ONE of the three forms below).
#
# S3-compatible:
#   storage_url: "s3://mybucket/backups?endpoint=s3.example.com&region=us-east-1"
#   (also set s3.access_key_id and s3.secret_access_key below)
#
# Local filesystem:
#   storage_url: "file:///mnt/backups/vaultik"
#
# Rclone (requires rclone configured separately):
#   storage_url: "rclone://myremote/path/to/backups"
storage_url: ""

# ─── S3 CREDENTIALS (required for s3:// storage_url) ────────────────────────

# s3:
#   access_key_id: YOUR_ACCESS_KEY
#   secret_access_key: YOUR_SECRET_KEY
#   # region: us-east-1        # Default: us-east-1
#   # part_size: 5MiB          # Upload part size, 5MiB to 5GiB. Default: 5MiB
#   # For the s3:// form, disable TLS with ?ssl=false in the URL, not use_ssl.

# ─── OPTIONAL ────────────────────────────────────────────────────────────────

# Global exclude patterns applied to ALL snapshots.
# Snapshot-specific excludes are additive.
# exclude:
#   - "*.log"
#   - "*.tmp"
#   - ".git"
#   - "node_modules"

# Average chunk size for content-defined chunking (FastCDC).
# Smaller = better deduplication but more metadata overhead.
# Minimum 1MB. Accepts: 1MB, 10M, 64MiB, etc.
# Default: 10MB
# chunk_size: 10MB

# Maximum blob size before splitting into a new blob.
# Must be at least four times chunk_size (the largest chunk the chunker can
# emit); a smaller limit would let a single-chunk blob exceed it.
# Accepts: 1GB, 10G, 500MB, etc.
# Default: 10GB
# blob_size_limit: 10GB

# Zstd compression level (1-19). Higher = better ratio but slower.
# Default: 3
# compression_level: 3

# How old a blob that no snapshot lists must be before prune deletes it,
# and how old every object in a directory under metadata/ with no manifest
# must be before prune deletes that directory. A backup uploads its blobs
# and its db.zst.age before its manifest, so on a destination shared
# between hosts or users this must be longer than the longest backup run.
# It does not protect a blob a backup reuses from an earlier run that
# stopped before its manifest: that blob keeps the time of its first
# upload, so a prune can delete it.
# Accepts: 36h, 90m, etc. 0s deletes such blobs and directories at once.
# Default: 24h
# prune_grace_period: 24h

# Hostname used in snapshot IDs. Default: system hostname.
# hostname: myserver

# Path to the local SQLite index database.
# Default: the platform data directory, e.g.
#   macOS: ~/Library/Application Support/vaultik/index.sqlite
#   Linux: ~/.local/share/vaultik/index.sqlite
# index_path: /path/to/index.sqlite
`

// NewConfigCommand creates the config command group.
func NewConfigCommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:   "config",
		Short: "Manage the configuration file",
		Long:  "Commands for creating, editing, and querying the vaultik config file.",
		// cobra checks Args only on a command that has a Run: without
		// one, a mistyped subcommand printed help and exited 0.
		Args: cobra.NoArgs,
		Run: func(cmd *cobra.Command, _ []string) {
			_ = cmd.Help()
		},
	}

	cmd.AddCommand(newConfigInitCommand())
	cmd.AddCommand(newConfigEditCommand())
	cmd.AddCommand(newConfigGetCommand())
	cmd.AddCommand(newConfigSetCommand())

	return cmd
}

// newConfigInitCommand creates the 'config init' subcommand.
func newConfigInitCommand() *cobra.Command {
	return &cobra.Command{
		Use:   "init",
		Short: "Write a default config file",
		Long: `Creates a default configuration file with commented explanations
for the settings it lists. If a config file already exists at the target
path, the command refuses to overwrite it. The file is created with mode
0600, because it can hold credentials.

The config is written to the path from --config, $VAULTIK_CONFIG, or
config.yml in the platform default config directory
(~/Library/Application Support/vaultik/ on macOS, ~/.config/vaultik/ on
Linux, /etc/vaultik/ as root).`,
		Args: cobra.NoArgs,
		RunE: func(cmd *cobra.Command, _ []string) error {
			path := configPathForInit()

			_, err := os.Stat(path)
			if err == nil {
				return fmt.Errorf("%w: %s", errConfigExists, path)
			}

			dir := filepath.Dir(path)

			err = os.MkdirAll(dir, configDirMode)
			if err != nil {
				return fmt.Errorf("creating config directory %s: %w", dir, err)
			}

			err = os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
			if err != nil {
				return fmt.Errorf("writing config file: %w", err)
			}

			// A written-confirmation, not scriptable output: route it
			// through the UI so it is styled and --quiet silences it.
			out := commandUI(cmd)
			out.Infof("Config written to %s.", path)
			out.Infof(
				"Edit it to set your age_recipients, snapshots, and storage_url.")

			return nil
		},
	}
}

// newConfigEditCommand creates the 'config edit' subcommand.
func newConfigEditCommand() *cobra.Command {
	return &cobra.Command{
		Use:   "edit",
		Short: "Open the config file in $EDITOR (vi when it is not set)",
		Args:  cobra.NoArgs,
		RunE: func(cmd *cobra.Command, _ []string) error {
			path, err := ResolveConfigPath()
			if err != nil {
				return err
			}

			editor := os.Getenv("EDITOR")
			if editor == "" {
				editor = "vi"
			}

			// Run $EDITOR through the shell, as git does, so a value
			// with arguments such as "code --wait" works. The path
			// goes in as an argument ("$@"), not into the command
			// text, so a path with spaces or quotes arrives whole.
			// sh -c takes the word after the command as $0, which
			// is why editor appears twice.
			//nolint:gosec // G204: launching the operator's own $EDITOR is the point
			ed := exec.CommandContext(cmd.Context(),
				"sh", "-c", editor+` "$@"`, editor, path)
			ed.Stdin = os.Stdin
			ed.Stdout = os.Stdout
			ed.Stderr = os.Stderr

			return ed.Run()
		},
	}
}

// newConfigGetCommand creates the 'config get' subcommand.
func newConfigGetCommand() *cobra.Command {
	return &cobra.Command{
		Use:   "get <key>",
		Short: "Print a config value by dotted path (e.g. storage_url, compression_level)",
		Args:  cobra.ExactArgs(1),
		RunE: func(cmd *cobra.Command, args []string) error {
			path, err := ResolveConfigPath()
			if err != nil {
				return err
			}

			root, err := loadYAMLFile(path)
			if err != nil {
				return err
			}

			node, err := yamlPathGet(root, strings.Split(args[0], "."))
			if err != nil {
				return err
			}

			// The value is scriptable output: it must stay machine-plain
			// (no marker, no color) and is never silenced by --quiet, so it
			// is written straight to stdout rather than through the UI.
			w := cmd.OutOrStdout()

			if node.Kind == yaml.ScalarNode {
				_, _ = fmt.Fprintln(w, node.Value)

				return nil
			}

			out, err := yaml.Marshal(node)
			if err != nil {
				return fmt.Errorf("marshaling value: %w", err)
			}

			_, _ = fmt.Fprint(w, string(out))

			return nil
		},
	}
}

// newConfigSetCommand creates the 'config set' subcommand.
func newConfigSetCommand() *cobra.Command {
	return &cobra.Command{
		Use:   "set <key> <value>",
		Short: "Set a config value by dotted path (e.g. compression_level 5)",
		Long: `Sets a scalar config value addressed by dotted YAML path and writes
the file back, preserving comments and formatting. Missing keys along
the path are created: as a list when the next path element is a
number, otherwise as a map.

If the config loads, a change after which it would not, such as
compression_level 99, is refused and the file is left unchanged. A
config that does not load, such as the one config init writes before
storage_url is set or one with a ${ENV:...} reference to a variable
not set here, is checked one setting at a time: only a change after
which the changed setting cannot be read, such as one giving it the
wrong type, is refused.

Examples:
  vaultik config set storage_url "file:///mnt/backups"
  vaultik config set storage_url "s3://bucket/prefix?endpoint=host&region=us-east-1"
  vaultik config set compression_level 9
  vaultik config set s3.bucket mybucket  # legacy S3 fields still supported`,
		Args: cobra.ExactArgs(configSetArgs),
		RunE: func(cmd *cobra.Command, args []string) error {
			path, err := ResolveConfigPath()
			if err != nil {
				return err
			}

			return writeConfigSet(commandUI(cmd), path, args[0], args[1])
		},
	}
}

// writeConfigSet applies key=value to the config at path, writes it back
// owner-only, and confirms the write by naming just the key through the
// UI writer (styled, and silenced by --quiet). The value is never
// echoed: it may be a secret such as s3.secret_access_key, and captured
// stdout or a pasted terminal would then leak it.
func writeConfigSet(out *ui.Writer, path, key, value string) error {
	root, err := loadYAMLFile(path)
	if err != nil {
		return err
	}

	oldData, err := marshalConfigYAML(root)
	if err != nil {
		return fmt.Errorf("marshaling config: %w", err)
	}

	keys := strings.Split(key, ".")

	err = yamlPathSet(root, keys, value)
	if err != nil {
		return err
	}

	data, err := marshalConfigYAML(root)
	if err != nil {
		return fmt.Errorf("marshaling config: %w", err)
	}

	setting, err := yamlPathOnly(root, keys)
	if err != nil {
		return err
	}

	settingData, err := marshalConfigYAML(setting)
	if err != nil {
		return fmt.Errorf("marshaling config: %w", err)
	}

	err = checkConfigChange(oldData, data, settingData)
	if err != nil {
		return fmt.Errorf("%w: %w", errWouldNotLoad, err)
	}

	err = os.WriteFile(path, data, configFileMode)
	if err != nil {
		return fmt.Errorf("writing config file: %w", err)
	}

	// os.WriteFile does not change the mode of a file that already exists,
	// so a config that was group- or world-readable stays that way. As it
	// may hold S3 credentials, tighten it to owner-only after writing.
	info, statErr := os.Stat(path)
	if statErr == nil && info.Mode().Perm()&0o044 != 0 {
		err = os.Chmod(path, configFileMode)
		if err != nil {
			return fmt.Errorf("tightening config file permissions: %w", err)
		}
	}

	out.Infof("Set %s.", key)

	return nil
}

// checkConfigChange returns the reason vaultik would not load newData, the
// config after a change, if the change brings that failure in. If oldData,
// the config before it, loads, the new one must load too. A config that
// does not load, such as one still being filled in or one with a ${...}
// reference that cannot be filled in here, is checked one setting at a
// time: settingData, the changed setting on its own, must decode into the
// config type.
func checkConfigChange(oldData, newData, settingData []byte) error {
	oldCfg, err := config.Parse(oldData)
	if err == nil && oldCfg.Validate() == nil {
		newCfg, err := config.Parse(newData)
		if err != nil {
			return err
		}

		return newCfg.Validate()
	}

	_, err = config.Parse(settingData)

	return err
}

// yamlPathOnly returns a document holding only the value at the dotted key
// path in root, inside the maps and lists that lead to it there.
func yamlPathOnly(root *yaml.Node, keys []string) (*yaml.Node, error) {
	node, err := yamlPathGet(root, keys)
	if err != nil {
		return nil, err
	}

	for i, key := range slices.Backward(keys) {
		parent, err := yamlPathGet(root, keys[:i])
		if err != nil {
			return nil, err
		}

		if parent.Kind == yaml.SequenceNode {
			node = &yaml.Node{
				Kind: yaml.SequenceNode, Content: []*yaml.Node{node},
			}
		} else {
			keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
			node = &yaml.Node{
				Kind: yaml.MappingNode, Content: []*yaml.Node{keyNode, node},
			}
		}
	}

	return &yaml.Node{Kind: yaml.DocumentNode, Content: []*yaml.Node{node}}, nil
}

// marshalConfigYAML renders a config document tree with 2-space indentation,
// matching defaultConfigTemplate. yaml.Marshal defaults to 4 spaces, which
// would reindent the whole file on the first `config set` despite the promise
// to preserve formatting.
func marshalConfigYAML(root *yaml.Node) ([]byte, error) {
	var buf bytes.Buffer

	enc := yaml.NewEncoder(&buf)
	enc.SetIndent(configYAMLIndent)

	err := enc.Encode(root)
	if err != nil {
		return nil, err
	}

	err = enc.Close()
	if err != nil {
		return nil, err
	}

	return buf.Bytes(), nil
}

// loadYAMLFile parses a YAML file into a yaml.Node document tree,
// which preserves comments and ordering for round-tripping.
func loadYAMLFile(path string) (*yaml.Node, error) {
	data, err := os.ReadFile(path) //nolint:gosec // G304: config path is operator-supplied
	if err != nil {
		return nil, fmt.Errorf("reading config file: %w", err)
	}

	var root yaml.Node

	err = yaml.Unmarshal(data, &root)
	if err != nil {
		return nil, fmt.Errorf("parsing config file: %w", err)
	}

	// An empty file yields a zero node; normalize to an empty mapping document.
	if root.Kind == 0 {
		root = yaml.Node{
			Kind:    yaml.DocumentNode,
			Content: []*yaml.Node{{Kind: yaml.MappingNode}},
		}
	}

	return &root, nil
}

// yamlPathGet navigates a dotted key path through mapping and sequence
// nodes and returns the value node. Numeric path components index into
// sequences (e.g. "age_recipients.0").
func yamlPathGet(root *yaml.Node, keys []string) (*yaml.Node, error) {
	node := root
	if node.Kind == yaml.DocumentNode {
		if len(node.Content) == 0 {
			return nil, errEmptyConfig
		}

		node = node.Content[0]
	}

	for i, key := range keys {
		switch node.Kind {
		case yaml.MappingNode:
			found := false

			for j := 0; j+1 < len(node.Content); j += 2 {
				if node.Content[j].Value == key {
					node = node.Content[j+1]
					found = true

					break
				}
			}

			if !found {
				return nil, fmt.Errorf("%w: %s",
					errKeyNotFound, strings.Join(keys[:i+1], "."))
			}
		case yaml.SequenceNode:
			idx, err := strconv.Atoi(key)
			if err != nil {
				return nil, fmt.Errorf("%w: %s",
					errNeedNumericIndex, strings.Join(keys[:i], "."))
			}

			if idx < 0 || idx >= len(node.Content) {
				return nil, fmt.Errorf("%w: index %d for %s (len %d)",
					errIndexOutOfRange, idx, strings.Join(keys[:i], "."),
					len(node.Content))
			}

			node = node.Content[idx]
		case yaml.DocumentNode, yaml.ScalarNode, yaml.AliasNode:
			return nil, fmt.Errorf("%w: %s",
				errNotMapOrList, strings.Join(keys[:i], "."))
		default:
			return nil, fmt.Errorf("%w: %s",
				errNotMapOrList, strings.Join(keys[:i], "."))
		}
	}

	return node, nil
}

// yamlPathSet navigates a dotted key path, creating missing keys as needed,
// and sets the final key to the given scalar value. Numeric path
// components index into sequences; an index equal to the sequence length
// appends a new element (e.g. "age_recipients.1" on a 1-element list).
func yamlPathSet(root *yaml.Node, keys []string, value string) error {
	node := root
	if node.Kind == yaml.DocumentNode {
		if len(node.Content) == 0 {
			node.Content = []*yaml.Node{{Kind: yaml.MappingNode}}
		}

		node = node.Content[0]
	}

	for i := range keys {
		last := i == len(keys)-1

		switch node.Kind {
		case yaml.MappingNode:
			node = yamlSetInMapping(node, keys, i, value, last)
		case yaml.SequenceNode:
			next, err := yamlSetInSequence(node, keys, i, value, last)
			if err != nil {
				return err
			}

			node = next
		case yaml.DocumentNode, yaml.ScalarNode, yaml.AliasNode:
			return fmt.Errorf("%w: %s",
				errNotMapOrList, strings.Join(keys[:i], "."))
		default:
			return fmt.Errorf("%w: %s",
				errNotMapOrList, strings.Join(keys[:i], "."))
		}
	}

	// config.Load reads the file through untyped YAML, which turns an
	// unquoted 00112233 into the number 38043 and 1e5 into 100000. Tagging
	// a string setting as a string makes the encoder quote such a value.
	// Other settings stay unquoted, so compression_level 9 is a number.
	// The encoder refuses to write a value that is not valid UTF-8 as a
	// string. Left untagged, such a value is written as base64 !!binary and
	// loads back unchanged.
	if configKeyIsString(keys) && utf8.ValidString(value) {
		node.Tag = yamlStringTag
	}

	return nil
}

// configKeyIsString reports whether the dotted key names a string in
// config.Config, following the fields' yaml tags, as s3.access_key_id and
// snapshots.home.exclude.0 do.
func configKeyIsString(keys []string) bool {
	typ := reflect.TypeFor[config.Config]()

	for _, key := range keys {
		switch {
		case typ.Kind() == reflect.Map || typ.Kind() == reflect.Slice:
			// The key is a snapshot name or a list index.
			typ = typ.Elem()
		case typ.Kind() == reflect.Struct:
			field, ok := yamlField(typ, key)
			if !ok {
				return false
			}

			typ = field.Type
		default:
			return false
		}
	}

	return typ.Kind() == reflect.String
}

// yamlField returns the field of struct type typ whose yaml tag names key.
func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
	for field := range typ.Fields() {
		name, _, _ := strings.Cut(field.Tag.Get("yaml"), ",")
		if name == key {
			return field, true
		}
	}

	return reflect.StructField{}, false
}

// yamlSetInMapping resolves (creating if needed) the value node for the
// path element keys[i] within a mapping node, setting it to value when it
// is the final path element, and returns the node to descend into.
func yamlSetInMapping(
	node *yaml.Node, keys []string, i int, value string, last bool,
) *yaml.Node {
	var valueNode *yaml.Node

	for j := 0; j+1 < len(node.Content); j += 2 {
		if node.Content[j].Value == keys[i] {
			valueNode = node.Content[j+1]

			break
		}
	}

	if valueNode == nil {
		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: keys[i]}
		valueNode = newPathNode(keys, i, value)
		node.Content = append(node.Content, keyNode, valueNode)
	} else if last {
		setScalar(valueNode, value)
	}

	return valueNode
}

// yamlSetInSequence indexes (or appends to) a sequence node using the
// numeric path element keys[i], setting the element to value when it is
// the final path element, and returns the node to descend into.
func yamlSetInSequence(
	node *yaml.Node, keys []string, i int, value string, last bool,
) (*yaml.Node, error) {
	idx, err := strconv.Atoi(keys[i])
	if err != nil {
		return nil, fmt.Errorf("%w: %s",
			errNeedNumericIndex, strings.Join(keys[:i], "."))
	}

	if idx < 0 || idx > len(node.Content) {
		return nil, fmt.Errorf("%w: index %d for %s (len %d)",
			errIndexOutOfRange, idx, strings.Join(keys[:i], "."),
			len(node.Content))
	}

	if idx == len(node.Content) {
		node.Content = append(node.Content, newPathNode(keys, i, value))
	} else if last {
		setScalar(node.Content[idx], value)
	}

	return node.Content[idx], nil
}

// newPathNode returns the node to create for the missing path element
// keys[i]: the value when it is the final path element, otherwise an empty
// list when the next path element is a number and an empty map when not.
func newPathNode(keys []string, i int, value string) *yaml.Node {
	if i == len(keys)-1 {
		return &yaml.Node{Kind: yaml.ScalarNode, Value: value}
	}

	_, err := strconv.Atoi(keys[i+1])
	if err == nil {
		return &yaml.Node{Kind: yaml.SequenceNode}
	}

	return &yaml.Node{Kind: yaml.MappingNode}
}

// setScalar overwrites a node in place with a plain scalar value.
func setScalar(n *yaml.Node, value string) {
	n.Kind = yaml.ScalarNode
	n.Tag = ""
	n.Value = value
	n.Content = nil
	n.Style = 0
}

// configPathForInit returns the config path to write, checking --config flag,
// VAULTIK_CONFIG env, and the platform default.
func configPathForInit() string {
	if rootFlags.ConfigPath != "" {
		return rootFlags.ConfigPath
	}

	if envPath := os.Getenv("VAULTIK_CONFIG"); envPath != "" {
		return envPath
	}

	return DefaultConfigPath()
}