#!/usr/bin/env bash
# The stub `bao` for ./granter-login.nix and ./lib/bootstrap-auth-list.nix. `FAKE_BAO_LOGIN` picks the login's
# answer, in openbao's wording: `ok`, `standby` (500, a node that is not active
# yet), `no-role` (400, no trusted chain), `no-chain-match` (400, a chain that
# no role accepts), `sealed` (503). `FAKE_BAO_STATUS_RC` is `status`'s exit
# status. `FAKE_BAO_LOGIN_FIRST`, when set, answers the first login with it and
# later ones with `FAKE_BAO_LOGIN`; `FAKE_BAO_COUNT` is the file counting them.
# `auth list` is answered per the `auth)` arm below.
echo "$*" >>"$FAKE_BAO_LOG"
case "$1" in
  login)
    n=$(($(cat "$FAKE_BAO_COUNT" 2>/dev/null || echo 0) + 1))
    echo "$n" >"$FAKE_BAO_COUNT"
    answer=$FAKE_BAO_LOGIN
    if [ "$n" = 1 ] && [ -n "${FAKE_BAO_LOGIN_FIRST-}" ]; then answer=$FAKE_BAO_LOGIN_FIRST; fi
    url='URL: PUT https://bao.t.local:8200/v1/auth/cert/login'
    case "$answer" in
      ok) printf 's.fake' ;;
      standby)
        printf 'Error authenticating: Error making API request.\n\n%s\nCode: 500. Errors:\n\n* local node not active but active cluster node not found\n' "$url" >&2
        exit 2
        ;;
      no-role)
        printf 'Error authenticating: Error making API request.\n\n%s\nCode: 400. Errors:\n\n* invalid certificate or no client certificate supplied\n' "$url" >&2
        exit 2
        ;;
      no-chain-match)
        printf 'Error authenticating: Error making API request.\n\n%s\nCode: 400. Errors:\n\n* no chain matching all constraints could be found for this login certificate\n' "$url" >&2
        exit 2
        ;;
      sealed)
        printf 'Error authenticating: Error making API request.\n\n%s\nCode: 503. Errors:\n\n* Vault is sealed\n' "$url" >&2
        exit 2
        ;;
    esac
    ;;
  auth)
    # `FAKE_BAO_LIST` picks `auth list`'s answer: `ok`, `standby` (500),
    # `denied` (403, a token the store refuses), `sealed` (503).
    # `FAKE_BAO_LIST_FIRST` answers only the first one with it.
    n=$(($(cat "$FAKE_BAO_LIST_COUNT" 2>/dev/null || echo 0) + 1))
    echo "$n" >"$FAKE_BAO_LIST_COUNT"
    answer=${FAKE_BAO_LIST-ok}
    if [ "$n" = 1 ] && [ -n "${FAKE_BAO_LIST_FIRST-}" ]; then answer=$FAKE_BAO_LIST_FIRST; fi
    url='URL: GET https://bao.t.local:8200/v1/sys/auth'
    case "$answer" in
      ok) printf '{"cert/":{},"oidc/":{}}' ;;
      standby)
        printf 'Error listing enabled authentications: Error making API request.\n\n%s\nCode: 500. Errors:\n\n* local node not active but active cluster node not found\n' "$url" >&2
        exit 2
        ;;
      denied)
        printf 'Error listing enabled authentications: Error making API request.\n\n%s\nCode: 403. Errors:\n\n* permission denied\n' "$url" >&2
        exit 2
        ;;
      sealed)
        printf 'Error listing enabled authentications: Error making API request.\n\n%s\nCode: 503. Errors:\n\n* Vault is sealed\n' "$url" >&2
        exit 2
        ;;
    esac
    ;;
  status)
    [ "${FAKE_BAO_STATUS_RC-0}" = 0 ] || {
      echo "fake bao: status: Vault is sealed" >&2
      exit 2
    }
    ;;
  *)
    echo "fake bao: unexpected call: $*" >&2
    exit 98
    ;;
esac