# Source this file to define vlq(), a small authenticated VictoriaLogs query
# helper backed by the caller's current Vault session.
vlq() (
  set -euo pipefail

  export VAULT_ADDR="${VAULT_ADDR:-https://vault.quorate.internal}"

  command -v vault >/dev/null 2>&1 || {
    printf 'vlq: vault CLI is required\n' >&2
    return 127
  }

  command -v vlogscli-prod >/dev/null 2>&1 || {
    printf 'vlq: vlogscli-prod is required\n' >&2
    return 127
  }

  local server="${VLQ_SERVER:-https://logs.quorate.internal/select/logsql/query}"
  local vault_path="${VLQ_VAULT_PATH:-secret/victorialogs/vmauth/query}"
  local vault_field="${VLQ_VAULT_FIELD:-token}"
  local history_file="${VLQ_HISTORY_FILE:-${XDG_STATE_HOME:-$HOME/.local/state}/vlq/history}"
  local tmpdir token_file

  tmpdir="$(mktemp -d "${TMPDIR:-/tmp}/vlq.XXXXXX")"
  chmod 700 "$tmpdir"
  trap 'rm -rf "$tmpdir"' EXIT

  token_file="$tmpdir/token"

  vault kv get -field="$vault_field" "$vault_path" >"$token_file"
  chmod 600 "$token_file"

  mkdir -p "$(dirname "$history_file")"

  if [[ $# -gt 0 ]]; then
    printf '%s\n\nq\n' "$*" | vlogscli-prod \
      -datasource.url="$server" \
      -bearerToken="file://$token_file" \
      -historyFile="$history_file"
    return
  fi

  vlogscli-prod \
    -datasource.url="$server" \
    -bearerToken="file://$token_file" \
    -historyFile="$history_file"
)