#!/bin/sh
# Create the Scaleway supplier-account KV entries with placeholder values
# (supplier convention platform/suppliers/<supplier>/<account>, founder
# decision 2026-10-08). The founder then replaces each `xxx` in the OpenBao UI.
#
# Runs under the ops-mason-construct grant (BAO_TOKEN from ~/.claude-bao-token),
# or silently by the founder:
#   warden access openbao-platform-admin-login --exec -- \
#     sh /home/worsch/ops-mason/scripts/put-scaleway-supplier-placeholders.sh
# Run 2026-10-18 under claude-MASON-WP-0015-T03: all three created at v1.
#
# -cas=0 refuses to write a path that already exists, so a real value is never
# overwritten; a rerun fails harmlessly. No secret values pass through this script.
# The receipt holds path, version and result only.
set -u
umask 077
receipt_dir=/home/worsch/.local/state/railiance/receipts
mkdir -p "$receipt_dir"
receipt="$receipt_dir/scaleway-supplier-placeholders.txt"
: >"$receipt"

put() {
  path=$1; shift
  if bao kv put -cas=0 "$path" "$@" >/dev/null 2>&1; then
    echo "$path created" >>"$receipt"
  else
    echo "$path not written (exists or denied)" >>"$receipt"
  fi
}

meta() {
  path=$1; shift
  bao kv metadata put "$@" "$path" >/dev/null 2>&1 \
    || echo "$path metadata not written" >>"$receipt"
}

# Same field names as platform/workloads/railiance/{scaleway/bootstrap,backup/object-storage}.
put platform/suppliers/scaleway/bootstrap \
  ACCESS_KEY=xxx SECRET_KEY=xxx DEFAULT_ORGANIZATION_ID=xxx DEFAULT_PROJECT_ID=xxx
meta platform/suppliers/scaleway/bootstrap \
  -custom-metadata=owner=railiance-platform \
  -custom-metadata=purpose=scaleway-bootstrap-iam-key \
  -custom-metadata=readers=none-yet

put platform/suppliers/scaleway/backup \
  ACCESS_KEY=xxx SECRET_KEY=xxx DEFAULT_ORGANIZATION_ID=xxx DEFAULT_PROJECT_ID=xxx
meta platform/suppliers/scaleway/backup \
  -custom-metadata=owner=railiance-platform \
  -custom-metadata=purpose=resource-control-scoped-backup-key \
  -custom-metadata=readers=none-yet

# MASON-WP-0014, temporary: tear down at MAS-WP-0003 close.
put platform/suppliers/scaleway/mas-tem-relay username=xxx password=xxx
meta platform/suppliers/scaleway/mas-tem-relay \
  -custom-metadata=owner=railiance-platform \
  -custom-metadata=purpose=mas-live-test-tem-smtp \
  -custom-metadata=readers=external-secrets-mas-tem-relay \
  -custom-metadata=plan=ops-mason/plans/mas-tem-relay-smtp.md

# Version numbers only; values are never read.
for p in bootstrap backup mas-tem-relay; do
  v=$(bao kv metadata get -format=json "platform/suppliers/scaleway/$p" 2>/dev/null \
      | sed -n 's/.*"current_version": *\([0-9]*\).*/\1/p' | head -1)
  echo "platform/suppliers/scaleway/$p current_version=${v:-unknown}" >>"$receipt"
done