#!/usr/bin/env bash
# Interactive diagnosis of the contained platform-admin OIDC login.
# Shows bao's own messages (Warden swallows them). Stores the token only in a
# throwaway helper, revokes it, and prints metadata — never the token.
set -euo pipefail
export BAO_ADDR="${BAO_ADDR:-http://127.0.0.1:18200}"
export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
mkdir -p "${HOME}/.warden-attended-login"
chmod 700 "${HOME}/.warden-attended-login"
ROOT="$(mktemp -d "${HOME}/.warden-attended-login/diag-XXXXXX")"
chmod 700 "$ROOT"
helper="$ROOT/.vault-token"
cleanup() {
  if [[ -s "$helper" ]]; then
    HOME="$ROOT" bao token revoke -self >/dev/null 2>&1 || true
  fi
  rm -rf "$ROOT"
}
trap cleanup EXIT
touch "$helper"
chmod 600 "$helper"
echo "BAO_ADDR=$BAO_ADDR"
echo "NTPSynchronized=$(timedatectl show -p NTPSynchronized --value 2>/dev/null || echo unknown)"
echo "isolated_home=$ROOT"
echo "starting bao login -no-print -method=oidc -path=netkingdom role=platform-admin"
echo "(complete the browser flow; this process must stay running for the callback)"
set +e
HOME="$ROOT" bao login -no-print -method=oidc -path=netkingdom role=platform-admin
rc=$?
set -e
mode=$(stat -c '%a' "$helper" 2>/dev/null || echo missing)
size=$(stat -c '%s' "$helper" 2>/dev/null || echo 0)
echo "login_exit=$rc helper_mode=$mode helper_bytes=$size"
if [[ "$rc" -eq 0 && "$size" -gt 0 ]]; then
  echo "login_ok_helper_populated"
else
  echo "login_failed_or_helper_empty"
fi