#!/bin/bash
# Authenticated Cloudron admin API call (compliant lever: api-token service
# account from vault item creds/cloudron — never the founder's accounts).
# usage: cloudron-api.sh METHOD /api/v1/PATH [JSON-BODY]
# body -> stdout; HTTP status -> stderr. Secrets never printed.
set -euo pipefail
BASE="https://my.knownelement.com"
METHOD="${1:?usage: cloudron-api.sh METHOD /api/v1/PATH [JSON-BODY]}"
PATHPART="${2:?usage: cloudron-api.sh METHOD /api/v1/PATH [JSON-BODY]}"
BODY="${3:-}"
if [ "$(id -un)" = "TSGCOO" ]; then
  SM() { /data2/TSGCOO/.local/bin/sm "$@" </dev/null; }
else
  SM() { sudo -u TSGCOO /data2/TSGCOO/.local/bin/sm "$@" </dev/null; }
fi
TOKEN=$(SM get creds/cloudron --field password)
[ -n "$TOKEN" ] || { echo "no cloudron token in vault" >&2; exit 1; }
ARGS=(-sk -X "$METHOD" "$BASE$PATHPART"
      -H "Authorization: Bearer $TOKEN"
      -H 'Content-Type: application/json'
      -w '\nHTTP %{http_code}\n')
[ -n "$BODY" ] && ARGS+=(-d "$BODY")
curl "${ARGS[@]}" >&2