#!/usr/bin/env bash
# Store a gitea username + PAT into OpenBAO KV at secret/gitea/push.
# Prompts for the PAT silently so it never appears in shell history or logs.
# Run from the project dir:  ./scripts/store-gitea-cred.sh
set -euo pipefail

ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
INIT="/home/lutz/Projects/OpenBAO/init-output.json"

read -rp "gitea username [lutz]: " U; U="${U:-lutz}"
read -rsp "gitea personal access token (input hidden): " P; echo
[ -n "$P" ] || { echo "no token entered, aborting"; exit 1; }

# Use the root token locally to write the secret (admin would also work).
TOKEN="$(python3 -c "import json;print(json.load(open('$INIT'))['root_token'])")"

# Build JSON safely with python (handles any special chars in the token).
payload="$(U="$U" P="$P" python3 -c 'import json,os;print(json.dumps({"data":{"username":os.environ["U"],"token":os.environ["P"]}}))')"

code="$(curl -sS -o /dev/null -w '%{http_code}' \
  -H "X-Vault-Token: ${TOKEN}" --data "$payload" \
  "${ADDR}/v1/secret/data/gitea/push")"
case "$code" in
  200|204) echo "stored secret/gitea/push (HTTP $code)";;
  *) echo "FAILED storing secret (HTTP $code)"; exit 1;;
esac