#!/bin/bash
# Generic Grist API wrapper using Vault for token retrieval
# Usage: bash vault_grist_api.sh <METHOD> <API_PATH> [optional: JSON_PAYLOAD_FILE]
# Example: bash vault_grist_api.sh GET /api/docs/wmBGUbgBveCdeY8fZ6T6eL/tables/Intune/records

METHOD="$1"
API_PATH="$2"
PAYLOAD_FILE="$3"

if [ -z "$METHOD" ] || [ -z "$API_PATH" ]; then
    echo "Usage: bash vault_grist_api.sh <METHOD> <API_PATH> [payload_file]"
    echo "Example: bash vault_grist_api.sh GET /api/docs/wmBGUbgBveCdeY8fZ6T6eL/tables/Intune/records"
    exit 1
fi

# Step 1: Authenticate to Vault
VAULT_AUTH=$(curl -sk -X POST \
  -d '{"role_id":"75d2dcfb-9c65-7f60-59b4-eee8c7f8dc0e","secret_id":"6202b465-2f25-547c-ec07-f47cfc4dda3e"}' \
  "https://beavault.beawit.net:8200/v1/auth/approle/login")

VAULT_TOKEN=*** "$VAULT_AUTH" | jq -r '.auth.client_token')

if [ -z "$VAULT_TOKEN" ] || [ "$VAULT_TOKEN" = "null" ]; then
    echo "Error: Vault authentication failed"
    exit 1
fi

# Step 2: Retrieve Grist token from Vault
GRIST_DATA=$(curl -sk -H "X-Vault-Token: $VAULT_TOKEN" \
  "https://beavault.beawit.net:8200/v1/kv/data/api/integration/grist")

GRIST_TOKEN=*** "$GRIST_DATA" | jq -r '.data.data.token')

if [ -z "$GRIST_TOKEN" ] || [ "$GRIST_TOKEN" = "null" ]; then
    echo "Error: Failed to retrieve Grist token from Vault"
    exit 1
fi

# Step 3: Make Grist API call
GRIST_URL="https://grist.beawit.net${API_PATH}"

if [ "$METHOD" = "GET" ]; then
    curl -sk "$GRIST_URL" \
      -H "Authorization: Bearer $GRIST_TOKEN" \
      -H "Content-Type: application/json"
elif [ "$METHOD" = "PATCH" ] && [ -n "$PAYLOAD_FILE" ]; then
    curl -sk "$GRIST_URL" \
      -H "Authorization: Bearer $GRIST_TOKEN" \
      -H "Content-Type: application/json" \
      -X PATCH \
      -d "@$PAYLOAD_FILE"
else
    echo "Error: Unsupported method or missing payload file for PATCH"
    exit 1
fi