#!/usr/bin/env bash
set -euo pipefail
# curl + Node 22. Never enable shell tracing around bearer credentials.
: "${APP_ORIGIN:?Set APP_ORIGIN to the returned HTTPS app origin}"
: "${BEARER:?Set the app owner BEARER}"
case "$APP_ORIGIN" in https://*|http://127.0.0.1:*|http://localhost:*) ;; *) echo 'HTTPS required' >&2; exit 2;; esac
action=${1:-list}
case "$action" in
  list) method=GET; suffix=; payload= ;;
  create) method=POST; suffix=; payload=$(node -e 'process.stdout.write(JSON.stringify({hostname:process.argv[1],recordType:process.argv[2]}))' "${2:?Supply hostname}" "${3:-A}") ;;
  verify|remove)
    [[ ${2:-} =~ ^dom_[a-f0-9]{32}$ ]] || { echo 'Supply returned bindingId' >&2; exit 2; }
    suffix=/$2; payload=
    if [[ $action == verify ]]; then method=POST; suffix+=/verify; else method=DELETE; fi ;;
  *) echo 'Use create HOST [A|CNAME], list, verify ID, remove ID' >&2; exit 2 ;;
esac
args=(--fail-with-body --silent --show-error --max-time 30 --request "$method"
  --header "authorization: Bearer $BEARER" --header 'content-type: application/json')
[[ -z $payload ]] || args+=(--data "$payload")
curl "${args[@]}" "${APP_ORIGIN%/}/api/domains$suffix"