#!/usr/bin/env bash
# Mint a read-limited OpenBao token on coulombcore (bao.coulomb.social) and store
# it on railiance01 for ClusterSecretStore openbao-activity-core / ExternalSecrets:
#   - actcore-issue-core-runtime  (ISSUE_CORE_API_KEY)
#   - actcore-forgejo-admin       (FORGEJO_TOKEN for package prune)
#   - actcore-backup-offsite      (NC_WEBDAV_* for Option A backups)
#
# Default policies (already present in OpenBao; files re-written when present):
#   workload-kv-read-issue-core-runtime
#   workload-kv-read-forgejo-admin
#   workload-kv-read-railiance-backup-offsite-lane
set -euo pipefail

# Space-separated policy names. Override with OPENBAO_ACTIVITY_CORE_POLICIES.
DEFAULT_POLICIES="workload-kv-read-issue-core-runtime workload-kv-read-forgejo-admin workload-kv-read-railiance-backup-offsite-lane"
POLICIES="${OPENBAO_ACTIVITY_CORE_POLICIES:-$DEFAULT_POLICIES}"
POLICY_DIR="${OPENBAO_POLICY_DIR:-$HOME/railiance-platform/openbao/policies}"
BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
SECRET_NAME="${OPENBAO_ACTIVITY_CORE_ESO_SECRET:-openbao-activity-core-eso-token}"
SECRET_NS="${OPENBAO_ACTIVITY_CORE_ESO_NAMESPACE:-external-secrets}"

if ! command -v bao >/dev/null 2>&1; then
  echo "ERROR: bao CLI not found" >&2
  exit 1
fi

echo "OpenBao addr: $BAO_ADDR"
echo "Policies: $POLICIES"

if [[ -n "${BAO_TOKEN:-}" ]]; then
  :
elif [[ -n "${OPENBAO_TOKEN_FILE:-}" && -f "${OPENBAO_TOKEN_FILE}" ]]; then
  BAO_TOKEN="$(head -n 1 "${OPENBAO_TOKEN_FILE}")"
else
  read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
  echo >&2
fi

if [[ -z "${BAO_TOKEN:-}" ]]; then
  echo "ERROR: empty OpenBao token" >&2
  exit 1
fi

export BAO_ADDR BAO_TOKEN

health="$(curl -fsS "$BAO_ADDR/v1/sys/health")"
if echo "$health" | grep -q '"sealed":true'; then
  echo "ERROR: OpenBao at $BAO_ADDR reports sealed" >&2
  exit 1
fi

policy_flags=()
for policy in $POLICIES; do
  policy_file="$POLICY_DIR/${policy}.hcl"
  if [[ -f "$policy_file" ]]; then
    bao policy write "$policy" "$policy_file"
  else
    echo "WARN: policy file missing ($policy_file); using existing OpenBao policy '$policy'" >&2
  fi
  policy_flags+=(-policy="$policy")
done

token_json="$(bao token create "${policy_flags[@]}" \
  -display-name="eso-activity-core-runtime" \
  -period=720h \
  -format=json)"
token="$(python3 -c "import json,sys; print(json.load(sys.stdin)['auth']['client_token'])" <<<"$token_json")"

KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create namespace "$SECRET_NS" --dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create secret generic "$SECRET_NAME" \
  --namespace "$SECRET_NS" \
  --from-literal=token="$token" \
  --dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -

unset BAO_TOKEN token token_json
echo "ok: applied $SECRET_NS/$SECRET_NAME on railiance01 (token not printed)"
echo "ok: policies attached: $POLICIES"