#!/bin/bash

replacePlainPasswords() 
{
    local file="$1"

    # Only scan for placeholders that actually exist in the file.
    #
    # The \b on the substitution below is load-bearing once a file uses ten or
    # more slots. `sort -u` orders these lexically — 1, 10, 11, 2 — so an
    # unanchored `s/RANDOMIZEDPASSWORD1/<secret>/g` runs first and rewrites the
    # RANDOMIZEDPASSWORD1 *inside* RANDOMIZEDPASSWORD10, leaving slot 10 holding
    # slot 1's secret with a stray "0" on the end. Slots 10+ then share a secret
    # derivable from slot 1, and nothing downstream notices because the values
    # aren't byte-identical. The word boundary makes the match order irrelevant.
    local existing_placeholders=$(runCfgOp grep -oE 'RANDOMIZEDPASSWORD[0-9]+' "$file" 2>/dev/null | sort -u)
    
    if [[ -n "$existing_placeholders" ]]; then
        while IFS= read -r password_placeholder; do
            if [[ -n "$password_placeholder" ]]; then
                local random_password=$(generateRandomPassword)
                runCfgOp sed -i 's/'"${password_placeholder}"'\b/'"${random_password}"'/g' "$file"
                checkSuccess "Updated ${password_placeholder} in $(basename "$file")."
            fi
        done <<< "$existing_placeholders"
    fi
}