#!/usr/bin/env bash
# Run from the checkout whose isolated dev server is running.
# OUT must be a private scratch directory; generated credentials are never uploaded.
set -euo pipefail
: "${OUT:?Set OUT to a private scratch directory}"
run_dir="$OUT/$(date -u +%Y%m%dT%H%M%SZ)-$RANDOM"
mkdir -p "$run_dir"
case "${1:-}" in
  pair)
    node apps/server/src/bin.ts auth pairing create --base-dir .t3 --label "${2:?label}" --json > "$run_dir/pair.json"
    echo "$run_dir/pair.json"
    ;;
  sessions)
    node apps/server/src/bin.ts auth session list --base-dir .t3 --json > "$run_dir/sessions.json"
    echo "$run_dir/sessions.json"
    ;;
  revoke)
    node apps/server/src/bin.ts auth session revoke "${2:?session id}" --base-dir .t3 > "$run_dir/revoke.txt"
    cat "$run_dir/revoke.txt"
    ;;
  *) echo 'Usage: auth-driver.sh pair LABEL | sessions | revoke SESSION_ID' >&2; exit 2 ;;
esac