#!/usr/bin/env bash
# Scenario B (transit blob): encrypt a file with OpenBAO's transit key
# `personal-backup`. OpenBAO holds only the KEY; the ciphertext is a portable
# blob you can store anywhere (Synology, git, offsite). Output is ASCII.
#   secret-encrypt.sh <infile> [outfile]   (default outfile: <infile>.vaultenc)
set -euo pipefail
ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
TOKF="$HOME/.config/openbao/personal-transit.token"
KEY="personal-backup"
in="${1:?usage: secret-encrypt.sh <infile> [outfile]}"; out="${2:-$in.vaultenc}"
[ -r "$TOKF" ] || { echo "no token at $TOKF" >&2; exit 1; }
[ -r "$in" ]   || { echo "no input file: $in" >&2; exit 1; }

ct="$(base64 -w0 "$in" \
  | python3 -c 'import json,sys;print(json.dumps({"plaintext":sys.stdin.read()}))' \
  | curl -sS -H "X-Vault-Token: $(cat "$TOKF")" --data @- "$ADDR/v1/transit-personal/encrypt/$KEY" \
  | jq -r '.data.ciphertext // empty')"
[ -n "$ct" ] || { echo "encrypt failed" >&2; exit 1; }
printf '%s\n' "$ct" > "$out"
echo "encrypted $in -> $out  ($(wc -c < "$out") bytes ciphertext)"