#!/usr/bin/env bash
# Scenario A: read a personal credential back.
#   personal-get.sh <name>            # show all fields
#   personal-get.sh <name> password   # print one field (for piping)
set -euo pipefail
ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
TOKF="$HOME/.config/openbao/personal-kv.token"
name="${1:?usage: personal-get.sh <name> [field]}"; field="${2:-}"
[ -r "$TOKF" ] || { echo "no token at $TOKF" >&2; exit 1; }

resp="$(curl -sS -H "X-Vault-Token: $(cat "$TOKF")" "$ADDR/v1/personal/data/$name")"
if printf '%s' "$resp" | jq -e '.errors and (.errors|length>0)' >/dev/null 2>&1; then
  echo "not found or no access: $name" >&2; exit 1; fi
if [ -n "$field" ]; then
  printf '%s' "$resp" | jq -r ".data.data.$field // empty"
else
  printf '%s' "$resp" | jq -r '.data.data | to_entries[] | "\(.key): \(.value)"'
fi