#!/bin/bash
set -euo pipefail

: '
vault write auth/approle/role/triage_agent \
    token_policies="agent_policy" \
    token_ttl=1h \
    token_max_ttl=4h \
    secret_id_ttl=24h \
    token_bound_cidrs="10.6.0.0/16"
'

VAULT_ADDR="https://10.6.2.1:8200"
if [ -z "${VAULT_TOKEN:-}" ]; then
  read -r -s -p "VAULT_TOKEN: " VAULT_TOKEN
  echo
fi

TARGET_DIR=${1:-'.'}

ROLE_NAME="triage_agent"
WRAP_TTL="600s"
CONFIG=$(mktemp)
chmod 600 "$CONFIG"
trap 'rm -f "$CONFIG"' EXIT

{
  printf 'header = "X-Vault-Token: %s"\n' "$VAULT_TOKEN"
  printf 'header = "X-Vault-Wrap-TTL: %s"\n' "$WRAP_TTL"
} > "$CONFIG"

curl -s -X POST -k -K "$CONFIG" \
  "$VAULT_ADDR/v1/auth/approle/role/${ROLE_NAME}/secret-id" \
  | jq -r '.wrap_info.token // .errors[0]' | tr -d '\n' > wrapped_secret_id