#!/usr/bin/env bash
set -Eeuo pipefail
if [ "$(id -u)" -ne 0 ]; then exec sudo bash "$0" "$@"; fi
command=${1:-qr}
cd /opt/prompt/current
compose(){ env -u AUTH_CONFIG_FILE -u AUTH_COOKIE_SECURE docker compose -p prompt --env-file /etc/prompt.env --env-file release.env -f compose.yml "$@"; }
case "$command" in
  qr|token) compose exec waterfall-wiki node auth-cli.cjs "$command" ;;
  rotate)
    if [ "${2:-}" != "--confirm" ]; then echo 'This invalidates all bound authenticators and JWT sessions. Use: auth rotate --confirm'; exit 1; fi
    compose run --rm --no-deps auth-admin node auth-cli.cjs rotate --confirm
    echo 'Rotation complete. Run auth qr to bind again.' ;;
  verify) compose exec -T waterfall-wiki node auth-cli.cjs verify ;;
  *) echo 'Usage: auth [qr | token | verify | rotate --confirm]'; exit 1 ;;
esac