#!/usr/bin/env bash
# Mint a read-limited OpenBao token and store it on railiance01 for
# ClusterSecretStore openbao-target-revenue (WP-0011).
set -euo pipefail

POLICY_NAME="${OPENBAO_TARGET_REVENUE_POLICY:-workload-kv-read-target-revenue-runtime}"
POLICY_FILE="${OPENBAO_TARGET_REVENUE_POLICY_FILE:-$HOME/railiance-platform/openbao/policies/workload-kv-read-target-revenue-runtime.hcl}"
BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
SECRET_NAME="${OPENBAO_TARGET_REVENUE_ESO_SECRET:-openbao-target-revenue-eso-token}"
SECRET_NS="${OPENBAO_TARGET_REVENUE_ESO_NAMESPACE:-external-secrets}"

if ! command -v bao >/dev/null 2>&1; then
  echo "ERROR: bao CLI not found" >&2
  exit 1
fi
if [[ ! -f "$POLICY_FILE" ]]; then
  echo "ERROR: policy file missing: $POLICY_FILE" >&2
  exit 1
fi

echo "OpenBao addr: $BAO_ADDR"
echo "Policy: $POLICY_NAME"

if [[ -n "${BAO_TOKEN:-}" ]]; then
  :
elif [[ -n "${OPENBAO_TOKEN_FILE:-}" && -f "${OPENBAO_TOKEN_FILE}" ]]; then
  BAO_TOKEN="$(head -n 1 "${OPENBAO_TOKEN_FILE}")"
else
  read -r -s -p "OpenBao operator token: " BAO_TOKEN
  echo >&2
fi
if [[ -z "${BAO_TOKEN:-}" ]]; then
  echo "ERROR: empty OpenBao token" >&2
  exit 1
fi

export BAO_ADDR BAO_TOKEN

health="$(curl -fsS "$BAO_ADDR/v1/sys/health")"
if echo "$health" | grep -q '"sealed":true'; then
  echo "ERROR: OpenBao at $BAO_ADDR reports sealed" >&2
  exit 1
fi

bao policy write "$POLICY_NAME" "$POLICY_FILE"
token_json="$(bao token create -policy="$POLICY_NAME" \
  -display-name="eso-target-revenue-runtime" -period=720h -format=json)"
token="$(python3 -c "import json,sys; print(json.load(sys.stdin)['auth']['client_token'])" <<<"$token_json")"

KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create namespace "$SECRET_NS" --dry-run=client -o yaml \
  | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create secret generic "$SECRET_NAME" \
  --namespace "$SECRET_NS" \
  --from-literal=token="$token" \
  --dry-run=client -o yaml \
  | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -

unset BAO_TOKEN token token_json
echo "ok: applied $SECRET_NS/$SECRET_NAME on railiance01 (token not printed)"