neiam /gitgud

defmodule GitGud.Secrets.OrganizationSecret do
  use Ecto.Schema
  import Ecto.Changeset

  alias GitGud.Organizations.Organization

  schema "organization_secrets" do
    field :name, :string
    field :ciphertext, :binary, redact: true
    field :iv, :binary, redact: true
    field :tag, :binary, redact: true
    field :key_id, :string

    belongs_to :organization, Organization

    timestamps(type: :utc_datetime)
  end

  @name_format ~r/\A[A-Za-z_][A-Za-z0-9_]*\z/

  def changeset(s, attrs) do
    s
    |> cast(attrs, [:name, :ciphertext, :iv, :tag, :key_id])
    |> validate_required([:name, :ciphertext, :iv, :tag, :key_id])
    |> validate_format(:name, @name_format,
      message: "must be a valid env var name (letters, digits, _, no leading digit)"
    )
    |> validate_length(:name, max: 100)
    |> GitGud.Secrets.ReservedNames.validate_not_reserved()
    |> unique_constraint(:name, name: :organization_secrets_organization_id_name_index)
  end
end