`scripts/arm-spend-reviews.sh`

34 lines
#!/bin/bash
# Spend->Reviews activation: wire George creds from secrets-manager + arm the
# posting executors. Idempotent (safe to re-run). Steve runs this via `! bash ...`.
# Arming posts NOTHING on its own — per-item approve + content-seal + confirm still gate every send.
set -euo pipefail
cd ~/Projects/AbramsEgo

# .env may not exist yet (app runs on defaults) — create it so sed/append work
touch .env

# --- wire George creds from the canonical secrets store (value never printed) ---
A=$(grep -m1 '^GEORGE_AUTH=' ~/Projects/secrets-manager/.env | cut -d= -f2-)
U=${A%%:*}
P=${A#*:}
sed -i '' '/^GEORGE_\(URL\|AUTH\|USER\|PASS\)=/d' .env
{
  echo "GEORGE_URL=http://localhost:9850"
  echo "GEORGE_AUTH=$A"
  echo "GEORGE_USER=$U"
  echo "GEORGE_PASS=$P"
} >> .env

# --- arm the posting edge ---
if grep -q '^SPEND_REVIEW_EXECUTORS_LIVE=' .env; then
  sed -i '' 's/^SPEND_REVIEW_EXECUTORS_LIVE=.*/SPEND_REVIEW_EXECUTORS_LIVE=1/' .env
else
  echo 'SPEND_REVIEW_EXECUTORS_LIVE=1' >> .env
fi

pm2 restart abramsego >/dev/null 2>&1 || true
sleep 2
curl -s -o /dev/null -w 'ready http=%{http_code}\n' -u admin:DW2024! http://127.0.0.1:9773/
echo "george keys set: $(grep -cE '^GEORGE_(URL|AUTH|USER|PASS)=' .env)/4 ; executors_live=$(grep -m1 '^SPEND_REVIEW_EXECUTORS_LIVE=' .env | cut -d= -f2-)"