src/bootstrap_secrets.py

import os
from pathlib import Path

import tomli_w

_SECRETS_PATH = Path(".streamlit/secrets.toml")


def ensure_secrets_file() -> None:
    if _SECRETS_PATH.exists() or "AUTH_CLIENT_ID" not in os.environ:
        return  # local dev already has the real file; skip if env unset

    _SECRETS_PATH.parent.mkdir(exist_ok=True)
    data = {
        "auth": {
            "redirect_uri": os.environ["AUTH_REDIRECT_URI"],
            "cookie_secret": os.environ["AUTH_COOKIE_SECRET"],
            "client_id": os.environ["AUTH_CLIENT_ID"],
            "client_secret": os.environ["AUTH_CLIENT_SECRET"],
            "server_metadata_url": "https://accounts.google.com/.well-known/openid-configuration",
        },
        "cookies": {
            "encryption_key": os.environ["COOKIE_ENCRYPTION_KEY"],
        },
    }
    _SECRETS_PATH.write_text(tomli_w.dumps(data))