#!/usr/bin/env bash
# Generates the current Google 2FA TOTP code from the stored secret.
# Reads /root/.aria-secrets/google.env. Outputs only the 6-digit code.
# Use: bash /root/aria/scripts/aria-google-totp.sh
#
# Note: does NOT source the env file (passwords may contain special chars
# that break bash sourcing). Extracts only GOOGLE_TOTP_SECRET via grep.

set -euo pipefail

ENV_FILE="/root/.aria-secrets/google.env"

if [ ! -r "$ENV_FILE" ]; then
  echo "ERROR: $ENV_FILE not readable" >&2
  exit 1
fi

SECRET=$(grep '^GOOGLE_TOTP_SECRET=' "$ENV_FILE" | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'" | tr -d '[:space:]')

if [ -z "$SECRET" ]; then
  echo "ERROR: GOOGLE_TOTP_SECRET not set in $ENV_FILE" >&2
  exit 2
fi

oathtool --totp -b "$SECRET"