#!/usr/bin/env bash
# Write ~/.verae/mcp-bearer (raw JWT only) from ~/.verae/auth.properties for Grok bearer_token_file.
set -euo pipefail
AUTH="${VERAE_AUTH_PROPERTIES:-$HOME/.verae/auth.properties}"
OUT="${VERAE_MCP_BEARER_FILE:-$HOME/.verae/mcp-bearer}"
if [[ ! -f "$AUTH" ]]; then
  echo "missing $AUTH" >&2
  exit 1
fi
python3 - "$AUTH" "$OUT" <<'PY'
import sys
from pathlib import Path
auth, out = Path(sys.argv[1]), Path(sys.argv[2])
vals = {}
for line in auth.read_text().splitlines():
    line = line.strip()
    if not line or line.startswith("#") or "=" not in line:
        continue
    k, v = line.split("=", 1)
    vals[k.strip()] = v.strip()
tok = vals.get("access_token") or vals.get("auth_token") or vals.get("id_token")
if not tok:
    raise SystemExit("no access_token/auth_token/id_token in auth.properties")
tmp = out.with_suffix(".tmp")
tmp.write_text(tok + "\n")
tmp.chmod(0o600)
tmp.replace(out)
out.chmod(0o600)
print(f"wrote {out} ({len(tok)} chars)")
PY