#!/bin/bash
# OpenBao Vault operations and Kubernetes Secret synchronization

sync_k8s_vault_token() {
    if kubectl --request-timeout=2s cluster-info >/dev/null 2>&1; then
        log_info "Синхронизация токена OpenBao в Kubernetes..."
        local bao_tok
        bao_tok=$(grep '^export VAULT_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'")
        if [[ -n "${bao_tok}" ]]; then
            kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f - >/dev/null 2>&1 || true
            kubectl -n external-secrets create secret generic openbao-token \
              --from-literal=token="${bao_tok}" \
              --dry-run=client -o yaml | kubectl apply -f - >/dev/null 2>&1
            kubectl -n external-secrets rollout restart deployment external-secrets >/dev/null 2>&1 || true
            log_ok "Токен OpenBao в Kubernetes актуализирован."
        fi
    fi
}

unseal_vault() {
    local unseal_key target_vault_addr seal_status resp
    unseal_key=$(grep '^export VAULT_UNSEAL_KEY=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'")
    target_vault_addr=$(grep '^export VAULT_ADDR=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'")
    target_vault_addr="${target_vault_addr:-$VAULT_ADDR}"

    seal_status=$(curl -s --connect-timeout 2 "${target_vault_addr}/v1/sys/seal-status" 2>/dev/null || echo "")
    if [[ -z "${seal_status}" ]]; then
        log_warn "OpenBao (${target_vault_addr}) недоступен. Пропуск ансила."
        return 0
    fi

    if echo "${seal_status}" | grep -q '"sealed":true'; then
        log_info "OpenBao запечатан. Ансил..."
        resp=$(printf '{"key":"%s"}' "${unseal_key}" | curl -s -X POST -H "Content-Type: application/json" --data-binary @- "${target_vault_addr}/v1/sys/unseal")
        if echo "${resp}" | grep -q '"sealed":false'; then
            log_ok "OpenBao успешно распечатан."
            sync_k8s_vault_token
        else
            log_err "Ошибка ансила OpenBao: ${resp}"
            return 1
        fi
    else
        log_ok "OpenBao распечатан."
        sync_k8s_vault_token
    fi
}