#!/usr/bin/env bash
# Parent-env wrapper for the attended tenant-engine sender mint.
#
# `warden access` runs OIDC from the *caller* environment, not from the
# `env ...` child argv. BAO_ADDR must be set here or bao login talks to
# the wrong address and fails before the mint script starts.
set -euo pipefail
export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
export WARDEN_ROUTING_CATALOG="${WARDEN_ROUTING_CATALOG:-$HOME/ops-warden/registry/routing/catalog.yaml}"
cd "$(dirname "$0")/.."
exec warden access openbao-platform-admin-login --exec -- \
  env RAILIANCE01_KUBECONFIG="$RAILIANCE01_KUBECONFIG" \
      BAO_ADDR="$BAO_ADDR" \
      VAULT_ADDR="$VAULT_ADDR" \
  "$PWD/scripts/mint-tenant-engine-sender.py"