#!/bin/bash
set -euo pipefail

echo "=== Secret Cleanup ==="

# Remove any Podman secrets created during testing
podman secret ls --format "{{.Name}}" 2>/dev/null | grep -E "(fetchml|test|dev)" | xargs -r podman secret rm 2>/dev/null || true

# Clear temporary credential files
rm -f /tmp/fetchml_*_key 2>/dev/null || true
rm -f /tmp/test_*_secret 2>/dev/null || true
rm -f /tmp/*.pem 2>/dev/null || true

# Reset example config permissions (ensure they're not world-readable)
find configs/ -name "*.yaml" -o -name "*.yml" -o -name "*.toml" 2>/dev/null | while read f; do
    if [[ "$f" != *example* ]]; then
        chmod 600 "$f" 2>/dev/null || true
    fi
done

echo "✓ Secret cleanup complete"