#!/usr/bin/env bash
# git credential helper backed by OpenBAO KV (secret/gitea/push).
# Configured per-host (see README), so it only answers for the gitea remote.
# git invokes it as:  git-credential-openbao.sh get   (request on stdin)
set -euo pipefail

[ "${1:-}" = "get" ] || exit 0   # we only serve credentials; ignore store/erase

ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
TOKF="${OPENBAO_GIT_TOKEN_FILE:-$HOME/.config/openbao/git-cred.token}"
[ -r "$TOKF" ] || exit 0
TOK="$(cat "$TOKF")"

resp="$(curl -sS --max-time 5 -H "X-Vault-Token: ${TOK}" \
  "${ADDR}/v1/secret/data/gitea/push" 2>/dev/null)" || exit 0
user="$(printf '%s' "$resp" | jq -r '.data.data.username // empty')"
pass="$(printf '%s' "$resp" | jq -r '.data.data.token // empty')"
[ -n "$user" ] && [ -n "$pass" ] || exit 0

printf 'username=%s\npassword=%s\n' "$user" "$pass"