#!/usr/bin/env bash
set -euo pipefail

# Copy only the two scoped receiver credentials into user-engine. Values stay
# in process memory and Kubernetes API requests; stdout contains metadata only.
audit_json="$(kubectl -n audit-core get secret audit-core-senders -o jsonpath='{.data.senders\.json}' | base64 -d)"
event_token="$(python3 -c 'import json,sys; rows=json.load(sys.stdin); print(next(row["tokens"][0] for row in rows if row["name"] == "user-engine"))' <<<"$audit_json")"
mail_token="$(kubectl -n email-connect get secret email-connect-runtime -o jsonpath='{.data.EMAIL_CONNECT_INGEST_TOKEN}' | base64 -d)"

test -n "$event_token"
test -n "$mail_token"

kubectl -n user-engine create secret generic user-engine-delivery \
  --from-literal=event-token="$event_token" \
  --from-literal=mail-token="$mail_token" \
  --dry-run=client -o yaml \
  | kubectl apply -f - >/dev/null

echo "user-engine delivery Secret synchronized (values withheld)"