httokensh

#!/bin/bash
#
# Run htgettoken and then start a shell command and keep the access
# token updated for as long as the command runs.  See httokensh(1).
#
# Written by Dave Dykstra August 2023

usage()
{
    echo "Usage: httokensh [-h] [htgettokenoptions] -- [command]"
    echo 
    echo "Runs htgettoken with given options, starts the command, and runs"
    echo "htgettoken again in the background as needed to renew the token"
    echo "until the command exits."
    echo
    echo "Options:"
    echo "  -h, --help     show this help message and exit"
    echo
    echo "command defaults to \$SHELL"
    exit 1
} >&2

if [ $# = 0 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
    usage
fi

HTGETOKENARGS=()
COMMANDARGS=()
GOTSEP=false
MINSECS=60
GOTVERBOSE=false
GOTOUTFILE=false
OUTFILE=""
GOTVTFILE=false
GOTVTTTL=false
# look at HTGETTOKENOPTS in addition to those options on the command line
# but don't explicitly pass them again to htgettoken
HTGETSEP="--HTSEP--"
set -- $HTGETTOKENOPTS $HTGETSEP "$@"
DONEHTGETTOKENOPTS=false
for ARG; do
    if $GOTSEP; then
        COMMANDARGS+=("$ARG")
    elif $GOTOUTFILE; then
        OUTFILE="$ARG"
        GOTOUTFILE=false
        if $DONEHTGETTOKENOPTS; then
            HTGETTOKENARGS+=("$ARG")
        fi
    elif [ "$ARG" = "$HTGETSEP" ]; then
        DONEHTGETTOKENOPTS=true
    elif [ "$ARG" = "--" ]; then
        GOTSEP=true
    else
        if $DONEHTGETTOKENOPTS; then
            HTGETTOKENARGS+=("$ARG")
        fi
        case "$ARG" in
            --minsecs=*)
                MINSECS="${ARG/--minsecs=/}"
                ;;
            -v|--verbose)
                GOTVERBOSE=true
                ;;
            -o)
                GOTOUTFILE=true
                ;;
            --outfile=*)
                OUTFILE="${ARG/--outfile=/}"
                ;;
            --vaulttokenfile=*)
                GOTVTFILE=true
                ;;
            --vaulttokenttl=*|--vaulttokenminttl=*)
                GOTVTTTL=true
                ;;
        esac
    fi
done

if ! $GOTSEP; then
    echo "No -- separator given" >&2
    usage
fi

if [ ${#HTGETTOKENARGS[@]} = 0 ]; then
    echo "No htgettoken options given" >&2
    usage
fi

if [ ${#COMMANDARGS[@]} = 0 ]; then
    COMMANDARGS=("$SHELL")
fi

if [ -z "$BEARER_TOKEN_FILE" ]; then
    if [ -n "$OUTFILE" ]; then
        BEARER_TOKEN_FILE="$OUTFILE"
    else
        BTFILE="bt_u$(id -u).sh-$$"
        if [ -n "$XDG_RUNTIME_DIR" ]; then
            BEARER_TOKEN_FILE=$XDG_RUNTIME_DIR/$BTFILE
        else
            BEARER_TOKEN_FILE=/tmp/$BTFILE
        fi
    fi
    export BEARER_TOKEN_FILE
fi

if ! $GOTVTFILE; then
    ARGHASH="$(echo "${HTGETTOKENARGS[@]}"|md5sum -)"
    ARGHASH="${ARGHASH%% *}"
    VTFILE="/tmp/vt_u$(id -u).sh-$ARGHASH"
    HTGETTOKENARGS+=("--vaulttokenfile=$VTFILE")
fi

if ! $GOTVTTTL; then
    HTGETTOKENARGS+=("--vaulttokenminttl=6d")
fi

gettoken()
{
    htgettoken "${HTGETTOKENARGS[@]}"
    RETVAL="$?"
    if [ $RETVAL != 0 ]; then
        echo "htgettoken failed, $1" >&2
        exit $RETVAL
    fi

    TOKENJSON="$(htdecodetoken)"
    RETVAL="$?"
    if [ $RETVAL != 0 ]; then
        echo "htdecodetoken failed, $1" >&2
        exit $RETVAL
    fi

    EXP="$(echo $TOKENJSON|jq .exp)"
    NOW="$(date +%s)"
    let SLEEPSECS="$EXP - $MINSECS - $NOW + 2"
    if [ "$SLEEPSECS" -lt $2 ]; then
        echo "Calculated renewal time of $SLEEPSECS seconds is less than $2, $1"
        exit 1
    fi
}

# The first time it is possible to get a cached token that is barely
# beyond the minsecs, so reduce the minimum to just 1 second
gettoken "not running command" 1

# Remove any --vaulttokenminttl option so the background renewal
#  gets to be as long as possible
if [[ "$HTGETTOKENOPTS" = *--vaulttokenminttl* ]]; then
    HTGETTOKENOPTS="$(echo "$HTGETTOKENOPTS"|sed 's/--vaulttokenminttl=[^ ]*//')"
fi
NEWARGS=()
for ARG in "${HTGETTOKENARGS[@]}"; do
    if [[ "$ARG" != --vaulttokenminttl* ]]; then
        NEWARGS+=("$ARG")
    fi
done
HTGETTOKENARGS=("${NEWARGS[@]}")

# make sure the logged info is verbose for easier diagnosis
if ! $GOTVERBOSE; then
    HTGETTOKENARGS+=("-v")
fi

# prevent attempts to get new vault token in background
HTGETTOKENARGS+=("--nooidc" "--nokerberos" "--nossh")

# enable job control so background processes get their own process group
set -m

echo "Renewal log is at \$BEARER_TOKEN_FILE.log"
{
    # keep a copy of $PPID because it will change to 1 if parent dies
    PARENTPID=$PPID
    echo htgettoken args are "${HTGETTOKENARGS[@]}"
    while true; do
        date
        echo "Renewal scheduled in $SLEEPSECS seconds"
        sleep $SLEEPSECS
        date
        if kill -0 $PARENTPID; then
            gettoken "exiting" 60
        else
            echo "Parent process $PARENTPID not running, exiting"
            exit 0
        fi
    done
} >$BEARER_TOKEN_FILE.log 2>&1 &

BACKGROUND_PID=$!

cleanup()
{
    if kill -- -$BACKGROUND_PID 2>/dev/null; then
        wait 2>/dev/null
        rm -f $BEARER_TOKEN_FILE $BEARER_TOKEN_FILE.log
    else
        echo >&2
        echo "Renewal background process failed, see $BEARER_TOKEN_FILE.log" >&2
        exit 1
    fi
}

trap cleanup 0

"${COMMANDARGS[@]}"