#!/usr/bin/env bash
# Put a Canvas access token into ~/.automation.env, correctly, without anyone
# typing a filename or a key name.
#
# This exists because two hand-attempts failed in two different ways: a paste
# landed in the command line instead of the prompt and overwrote the literal
# text CANVAS_TOKEN, then a paste in an editor landed on the neighbouring line
# so the token became the value of CANVAS_TOKEN_EXPIRES. Both left a file that
# looked plausible and was wrong, and both burned a token.
#
#   bin/set-canvas-token        (on the machine that runs the archive)
#
# It validates the shape of both values before writing anything, strips every
# existing CANVAS_ line so a retry cannot leave duplicates, and never echoes
# the token or writes it to a temp file outside the same directory.
set -euo pipefail
umask 077

ENV="${AUTOMATION_ENV:-$HOME/.automation.env}"
[ -f "$ENV" ] || { touch "$ENV"; chmod 600 "$ENV"; }

read -rsp "Canvas token (input hidden): " TOKEN; echo
read -rp  "Expiry as YYYY-MM-DD: " EXPIRES

# Canvas tokens are <numeric id>~<alphanumeric>. Checking the shape is what
# catches an empty read or a mis-aimed paste before it reaches the file.
if [[ ! "$TOKEN" =~ ^[0-9]+~[A-Za-z0-9]+$ ]]; then
    echo "That is not a Canvas token (expected 1234~alphanumeric). Nothing written." >&2
    exit 1
fi
if [[ ! "$EXPIRES" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
    echo "Expiry must be YYYY-MM-DD. Nothing written." >&2
    exit 1
fi

TMP="$(mktemp "$(dirname "$ENV")/.automation.env.XXXXXX")"
trap 'rm -f "$TMP"' EXIT
grep -vE '^CANVAS_(HOST|TOKEN|TOKEN_EXPIRES)=' "$ENV" > "$TMP" || true
{
    echo "CANVAS_HOST=${CANVAS_HOST:-canvas.stanford.edu}"
    echo "CANVAS_TOKEN=$TOKEN"
    echo "CANVAS_TOKEN_EXPIRES=$EXPIRES"
} >> "$TMP"
chmod 600 "$TMP"
mv "$TMP" "$ENV"
trap - EXIT

echo "written: $(grep -c '^CANVAS_' "$ENV") CANVAS_ lines, expiry $EXPIRES"
