#!/usr/bin/env sh
# Seed distinct local-only, synthetic, and approved operational credentials.
set -eu
umask 077
secret_path=kv/atlas/hermes/suite-planning-api
payload_file=/tmp/suite-tokens.json
trap 'rm -f "$payload_file"' EXIT HUP INT TERM
attempt=0
while [ "$attempt" -lt 40 ]; do
  jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
  if VAULT_TOKEN="$(vault write -field=token auth/kubernetes/login role=hermes-suite-token-seed jwt="$jwt" 2>/dev/null)"; then
    unset jwt
    export VAULT_TOKEN
    break
  fi
  unset jwt
  attempt=$((attempt + 1))
  sleep 30
done
test "$attempt" -lt 40 || exit 1
if existing="$(vault kv get -format=json "$secret_path" 2>&1)"; then
  unset existing
  for field in token synthetic_token; do
    value="$(vault kv get -field="$field" "$secret_path" 2>/dev/null)" || exit 1
    case "$value" in ''|*[!0-9a-f]*) exit 1 ;; esac
    test "${#value}" -eq 64 || exit 1
    unset value
  done
  if value="$(vault kv get -field=operational_token "$secret_path" 2>/dev/null)"; then
    case "$value" in ''|*[!0-9a-f]*) exit 1 ;; esac
    test "${#value}" -eq 64 || exit 1
    unset value
    printf 'Suite credentials already present; unchanged.\n'
    exit 0
  fi
  operational_token="$(vault write -field=random_bytes sys/tools/random/32 format=hex)"
  case "$operational_token" in ''|*[!0-9a-f]*) exit 1 ;; esac
  test "${#operational_token}" -eq 64 || exit 1
  printf '{"operational_token":"%s"}\n' "$operational_token" > "$payload_file"
  unset operational_token
  attempt=0
  until vault kv patch -method=patch "$secret_path" @"$payload_file" >/dev/null 2>&1; do
    attempt=$((attempt + 1))
    test "$attempt" -lt 40 || exit 1
    sleep 3
  done
  printf 'Operational credential added; existing credentials unchanged.\n'
  exit 0
fi
case "$existing" in *'No value found'*|*'Code: 404'*) ;; *) exit 1 ;; esac
unset existing
local_token="$(vault write -field=random_bytes sys/tools/random/32 format=hex)"
synthetic_token="$(vault write -field=random_bytes sys/tools/random/32 format=hex)"
operational_token="$(vault write -field=random_bytes sys/tools/random/32 format=hex)"
for value in "$local_token" "$synthetic_token" "$operational_token"; do
  case "$value" in ''|*[!0-9a-f]*) exit 1 ;; esac
  test "${#value}" -eq 64 || exit 1
done
printf '{"options":{"cas":0},"data":{"token":"%s","synthetic_token":"%s","operational_token":"%s"}}\n' \
  "$local_token" "$synthetic_token" "$operational_token" > "$payload_file"
unset local_token synthetic_token operational_token value
vault write kv/data/atlas/hermes/suite-planning-api @"$payload_file" >/dev/null 2>&1
printf 'Suite credentials created.\n'