#!/usr/bin/env bash
# Prints the four MK-* headers for a request, with nothing but OpenSSL 3 and
# coreutils: the shell version of packages/signing (contract section 1).
#
# The key is read from MYNTKAUP_API_KEY_ID and MYNTKAUP_API_PRIVATE_KEY, the
# names in the .env file the webapp gives you (MK_KEY_ID / MK_PRIVATE_KEY
# still work):
#
#   export MYNTKAUP_API_KEY_ID=mk_test_… MYNTKAUP_API_PRIVATE_KEY=mk_sk_…
#   scripts/sign-headers.sh GET /v1/me
#   curl https://public-api.staging.myntkaup.is/v1/me $(scripts/sign-headers.sh GET /v1/me | sed 's/^/-H /')   # values have no spaces
#
# Sign the exact body bytes you send. MK_TIMESTAMP and MK_NONCE may be set to
# reproduce the test vectors.
set -euo pipefail
OPENSSL="${OPENSSL:-openssl}"
method="$1" path="$2" body="${3:-}"
key_id="${MYNTKAUP_API_KEY_ID:-${MK_KEY_ID:?set MYNTKAUP_API_KEY_ID}}"
private_key="${MYNTKAUP_API_PRIVATE_KEY:-${MK_PRIVATE_KEY:?set MYNTKAUP_API_PRIVATE_KEY}}"
timestamp="${MK_TIMESTAMP:-$(( $(date +%s) * 1000 ))}"
nonce="${MK_NONCE:-$("$OPENSSL" rand -hex 16)}"
key="$(mktemp)"; msg="$(mktemp)"; trap 'rm -f "$key" "$msg"' EXIT
{ printf '302e020100300506032b657004220420' | xxd -r -p
  printf '%s=' "${private_key#mk_sk_}" | tr '_-' '/+' | base64 -d; } > "$key"
body_hash="$(printf '%s' "$body" | "$OPENSSL" dgst -sha256 -r | cut -d' ' -f1)"
printf 'myntkaup-public-v1\n%s\n%s\n%s\n%s\n%s\n%s' "$key_id" "$timestamp" "$nonce" "$method" "$path" "$body_hash" > "$msg"
signature="$("$OPENSSL" pkeyutl -sign -inkey "$key" -keyform DER -rawin -in "$msg" | base64 | tr -d '\n')"
echo "MK-Key-Id:$key_id"
echo "MK-Timestamp:$timestamp"
echo "MK-Nonce:$nonce"
echo "MK-Signature:$signature"