#!/usr/bin/env bash
#
# oncall_http.sh — make an authenticated request to the oncall service REST API
# without ever putting the API key on the command line.
#
# The key is read from the ONCALL_API_KEY environment variable, or from a .env
# file if that variable is not already set. The bearer header is assembled
# inside this script, so the secret never appears in the command you (or an AI
# agent) type — only the request path does. Do NOT echo/cat the key or paste it
# into a command; that would leak it into the transcript/context.
#
# Usage:
#   ONCALL_API_KEY=... ./oncall_http.sh --path /api/v1/me
#   ./oncall_http.sh --method POST --path /api/v1/overlays --body '{"type":"segment",...}'
#
# Options:
#   --path PATH        Request path, e.g. /api/v1/teams/payments (required)
#   --method METHOD    HTTP method, default GET
#   --query STRING     Raw query string, e.g. "team_ids=1&start_time=..."
#   --body STRING      Raw request body (usually JSON)
#   --body-file FILE   Read the request body from a file
#   --header STRING    Extra header, repeatable
#   --env-file FILE    .env file to source for ONCALL_API_KEY, default .env
#
# Environment:
#   ONCALL_API_KEY     Bearer key (oc_v2_...). Required. Set it in your shell or
#                      a gitignored .env file; never hard-code it in commands.
#   ONCALL_BASE_URL    API host, default https://oncall.pingcap.net (prod).
#                      Use http://localhost:8080 (or similar) for local/dev.

set -Eeuo pipefail

METHOD="GET"
REQ_PATH=""
QUERY=""
BODY=""
BODY_FILE=""
ENV_FILE="${ENV_FILE:-.env}"
EXTRA_HEADERS=()

log_err() { printf '%s\n' "$*" >&2; }

while [[ $# -gt 0 ]]; do
  case "$1" in
    --path)      REQ_PATH="${2:-}"; shift 2 ;;
    --method)    METHOD="${2:-}"; shift 2 ;;
    --query)     QUERY="${2:-}"; shift 2 ;;
    --body)      BODY="${2:-}"; shift 2 ;;
    --body-file) BODY_FILE="${2:-}"; shift 2 ;;
    --header)    EXTRA_HEADERS+=("${2:-}"); shift 2 ;;
    --env-file)  ENV_FILE="${2:-}"; shift 2 ;;
    -h|--help)   sed -n '2,30p' "$0"; exit 0 ;;
    *)           log_err "unknown argument: $1"; exit 2 ;;
  esac
done

if [[ -z "${REQ_PATH}" ]]; then
  log_err "--path is required"
  exit 2
fi

# Load the key from .env only if it is not already in the environment, so the
# value never has to be typed into a shell command.
if [[ -z "${ONCALL_API_KEY:-}" && -f "${ENV_FILE}" ]]; then
  # shellcheck disable=SC1090
  set -a; source "${ENV_FILE}"; set +a
fi

if [[ -z "${ONCALL_API_KEY:-}" ]]; then
  log_err "ONCALL_API_KEY is not set (export it or put it in ${ENV_FILE})"
  exit 1
fi

BASE_URL="${ONCALL_BASE_URL:-https://oncall.pingcap.net}"
URL="${BASE_URL%/}${REQ_PATH}"
[[ -n "${QUERY}" ]] && URL="${URL}?${QUERY}"

curl_args=(
  -sS
  -X "${METHOD}"
  -H "Authorization: Bearer ${ONCALL_API_KEY}"
  -H "Accept: application/json"
)

for h in "${EXTRA_HEADERS[@]:-}"; do
  [[ -n "${h}" ]] && curl_args+=(-H "${h}")
done

if [[ -n "${BODY_FILE}" ]]; then
  curl_args+=(-H "Content-Type: application/json" --data-binary "@${BODY_FILE}")
elif [[ -n "${BODY}" ]]; then
  curl_args+=(-H "Content-Type: application/json" --data "${BODY}")
fi

curl_args+=("${URL}")

curl "${curl_args[@]}"