#!/usr/bin/env bash
# The stub `bao` for ./agent-backend-env.nix. Leaves are files under
# `$FAKE_BAO_KV`, one per path. Every call is logged, a `kv` call without the
# token `login` printed fails, and the answers are the ones openbao gives:
# `kv get` of a leaf nobody wrote exits 2 with "No value found at <path>", and
# a policy granting `create` and `read` only refuses a second `-cas=0` write
# with a 403.
#
# `FAKE_BAO_LOGIN_RC` makes the login fail, `FAKE_BAO_DENY_READ` and
# `FAKE_BAO_DENY_WRITE` answer 403 as a policy that grants neither does, and
# `FAKE_BAO_RACE` has another writer create the leaf with that text between
# this run's first read and its write.
echo "$*" >>"$FAKE_BAO_LOG"
case "$1 $2" in
  "login -method=cert")
    [ "${FAKE_BAO_LOGIN_RC-0}" = 0 ] || {
      echo 'Error authenticating: Put "https://bao.t.local:8200/v1/auth/cert/login": dial tcp: lookup bao.t.local: no such host' >&2
      exit 2
    }
    printf 's.fake'
    ;;
  "kv get" | "kv put")
    [ "${BAO_TOKEN-}" = s.fake ] || {
      echo "fake bao: kv called without the login's token" >&2
      exit 97
    }
    ;;&
  "kv get")
    [ "$3" = -field=env ] || {
      echo "fake bao: get without -field=env: $*" >&2
      exit 95
    }
    leaf=$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)
    [ -z "${FAKE_BAO_DENY_READ-}" ] || {
      printf 'Error reading %s: Error making API request.\n\nURL: GET https://bao.t.local:8200/v1/%s\nCode: 403. Errors:\n\n* 1 error occurred:\n\t* permission denied\n' "$4" "$4" >&2
      exit 2
    }
    if [ -n "${FAKE_BAO_RACE-}" ] && [ ! -e "$FAKE_BAO_KV/.raced" ]; then
      : >"$FAKE_BAO_KV/.raced"
      printf '%s' "$FAKE_BAO_RACE" >"$leaf"
      echo "No value found at ${4/secret\//secret/data/}" >&2
      exit 2
    fi
    if [ ! -e "$leaf" ]; then
      echo "No value found at ${4/secret\//secret/data/}" >&2
      exit 2
    fi
    if [ "$(cat "$leaf.field" 2>/dev/null)" = other ]; then
      echo 'Field "env" not present in secret' >&2
      exit 1
    fi
    cat "$leaf"
    ;;
  "kv put")
    [ "$3" = -cas=0 ] || {
      echo "fake bao: put without -cas=0: $*" >&2
      exit 96
    }
    leaf=$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)
    case "$5" in
      env=@*) ;;
      *)
        echo "fake bao: put of something other than env=@file: $*" >&2
        exit 94
        ;;
    esac
    if [ -n "${FAKE_BAO_DENY_WRITE-}" ] || [ -e "$leaf" ]; then
      printf 'Error writing data to %s: Error making API request.\n\nURL: PUT https://bao.t.local:8200/v1/%s\nCode: 403. Errors:\n\n* 1 error occurred:\n\t* permission denied\n' "$4" "$4" >&2
      exit 2
    fi
    cp "${5#env=@}" "$leaf"
    ;;
  *)
    echo "fake bao: unexpected call: $*" >&2
    exit 98
    ;;
esac