#!/bin/bash
# vault_auth.sh - Vault authentication (fallback to direct auth)
# For cached access, use vault-env.sh instead

VAULT_URL="https://beavault.beawit.net:8200"

# Try cache first
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
if [ -x "${SCRIPT_DIR}/vault-cache.sh" ]; then
    TOKEN=$("${SCRIPT_DIR}/vault-cache.sh" get api/integration/grist token 2>/dev/null)
    if [ -n "$TOKEN" ]; then
        echo "$TOKEN"
        exit 0
    fi
fi

# Fallback to direct Vault auth
curl -sk -X POST \
  -d '{"role_id":"75d2dcfb-9c65-7f60-59b4-eee8c7f8dc0e","secret_id":"6202b465-2f25-547c-ec07-f47cfc4dda3e"}' \
  "${VAULT_URL}/v1/auth/approle/login" | jq -r '.auth.client_token'