#!/bin/bash
# vault-api-cached.sh - Drop-in replacement for vault_api.sh using local cache
#
# PURPOSE: Provides the same interface as vault_api.sh but uses local vault cache
# instead of querying Vault directly every time.
#
# USAGE: Same as vault_api.sh:
#   vault-api-cached.sh GET "https://grist.beawit.net" "/api/..." "api/business/grist" "Bearer"
#
# DIFFERENCES FROM vault_api.sh:
# - Uses ~/.cache/vault/ instead of ~/.openclaw/workspace/.tokens/
# - Falls back to vault_api.sh if cache is stale/missing
# - Supports all the same header types

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
VAULT_CACHE_SCRIPT="${SCRIPT_DIR}/vault-cache.sh"
VAULT_API_SCRIPT="${SCRIPT_DIR}/vault_api.sh"

METHOD="$1"
BASE_URL="$2"
API_PATH="$3"
# Strip trailing newlines from VAULT_KEY (can happen with Telegram input)
VAULT_KEY="$(echo -n "$4")"
HEADER_TYPE="${5:-Bearer}"
PAYLOAD_FILE="$6"

if [ -z "$METHOD" ] || [ -z "$BASE_URL" ] || [ -z "$API_PATH" ] || [ -z "$VAULT_KEY" ]; then
    echo "Usage: bash vault-api-cached.sh <METHOD> <BASE_URL> <API_PATH> <VAULT_KEY> [header_type] [payload_file]"
    echo ""
    echo "This script uses local vault cache for faster access."
    echo "Run './vault-cache.sh sync' to refresh cache."
    exit 1
fi

# Try to get token from cache first
get_cached_token() {
    local vault_key="$1"

    if [ ! -x "$VAULT_CACHE_SCRIPT" ]; then
        return 1
    fi

    # Try common field names: token, api_key, api-key, password
    local token
    token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" token 2>/dev/null)
    [ -n "$token" ] && { echo "$token"; return 0; }

    token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" api_key 2>/dev/null)
    [ -n "$token" ] && { echo "$token"; return 0; }

    token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" api-key 2>/dev/null)
    [ -n "$token" ] && { echo "$token"; return 0; }

    token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" password 2>/dev/null)
    [ -n "$token" ] && { echo "$token"; return 0; }

    return 1
}

# Build auth header based on type
build_auth_header() {
    local header_type="$1"
    local token="$2"

    case "$header_type" in
        "xc-token")
            echo "xc-token: $token"
            ;;
        "api-key"|"API-Key")
            echo "API-Key: $token"
            ;;
        "X-Api-Key"|"x-api-key")
            echo "X-Api-Key: $token"
            ;;
        "X-Vault-Token"|"vault")
            echo "X-Vault-Token: $token"
            ;;
        "Bearer"|*)
            echo "Authorization: Bearer $token"
            ;;
    esac
}

# Get service token (try cache first, fall back to vault_api.sh)
SERVICE_TOKEN=$(get_cached_token "$VAULT_KEY")

if [ -z "$SERVICE_TOKEN" ]; then
    echo "Cache miss for $VAULT_KEY, falling back to vault_api.sh..." >&2
    # Fall back to original vault_api.sh
    if [ -x "$VAULT_API_SCRIPT" ]; then
        "$VAULT_API_SCRIPT" "$@"
        exit $?
    else
        echo "Error: Neither cache nor vault_api.sh available" >&2
        exit 1
    fi
fi

AUTH_HEADER=$(build_auth_header "$HEADER_TYPE" "$SERVICE_TOKEN")
URL="${BASE_URL}${API_PATH}"
RESPONSE_FILE="/tmp/vault_api_cached_$$.json"

# Execute API call
curl_opts="-sk"
if [ "$METHOD" = "GET" ]; then
    curl $curl_opts \
      -H "$AUTH_HEADER" \
      -H "Content-Type: application/json" \
      -o "$RESPONSE_FILE" \
      "$URL"
elif [ "$METHOD" = "PATCH" ] && [ -n "$PAYLOAD_FILE" ]; then
    curl $curl_opts \
      -H "$AUTH_HEADER" \
      -H "Content-Type: application/json" \
      -X PATCH \
      -d "@$PAYLOAD_FILE" \
      -o "$RESPONSE_FILE" \
      "$URL"
elif [ "$METHOD" = "POST" ] && [ -n "$PAYLOAD_FILE" ]; then
    curl $curl_opts \
      -H "$AUTH_HEADER" \
      -H "Content-Type: application/json" \
      -X POST \
      -d "@$PAYLOAD_FILE" \
      -o "$RESPONSE_FILE" \
      "$URL"
else
    echo "Error: Unsupported method or missing payload file"
    rm -f "$RESPONSE_FILE"
    exit 1
fi

# Output response
cat "$RESPONSE_FILE"
rm -f "$RESPONSE_FILE"