#!/usr/bin/env bash
# Scenario A (structured KV): store a personal credential in the isolated
# `personal/` KV v2 engine (NOT readable by the day-to-day admin policy).
#   personal-put.sh <name>     e.g. personal-put.sh github
set -euo pipefail
ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
TOKF="$HOME/.config/openbao/personal-kv.token"
name="${1:?usage: personal-put.sh <name>}"
[ -r "$TOKF" ] || { echo "no token at $TOKF" >&2; exit 1; }

read -rp "username: " u
read -rsp "password (hidden): " p; echo
read -rp "url/notes (optional): " n

payload="$(U="$u" P="$p" N="$n" python3 -c \
  'import json,os;print(json.dumps({"data":{"username":os.environ["U"],"password":os.environ["P"],"url":os.environ["N"]}}))')"
code="$(printf '%s' "$payload" | curl -sS -o /dev/null -w '%{http_code}' \
  -H "X-Vault-Token: $(cat "$TOKF")" --data @- "$ADDR/v1/personal/data/$name")"
case "$code" in 200|204) echo "stored personal/$name (versioned)";; *) echo "FAILED (HTTP $code)"; exit 1;; esac