# Source this file to define vmq(), a small authenticated VictoriaMetrics query
# helper backed by the caller's current Vault session.
vmq() (
  set -euo pipefail

  export VAULT_ADDR="${VAULT_ADDR:-https://vault.quorate.internal}"

  if [[ $# -lt 1 ]]; then
    printf 'usage: vmq <promql expression>\n' >&2
    return 2
  fi

  command -v vault >/dev/null 2>&1 || {
    printf 'vmq: vault CLI is required\n' >&2
    return 127
  }

  command -v promtool >/dev/null 2>&1 || {
    printf 'vmq: promtool is required\n' >&2
    return 127
  }

  local server="${VMQ_SERVER:-https://metrics.quorate.internal/prometheus}"
  local vault_path="${VMQ_VAULT_PATH:-secret/victoriametrics/vmauth/query}"
  local vault_field="${VMQ_VAULT_FIELD:-token}"
  local tmpdir token_file http_config

  tmpdir="$(mktemp -d "${TMPDIR:-/tmp}/vmq.XXXXXX")"
  chmod 700 "$tmpdir"
  trap 'rm -rf "$tmpdir"' EXIT

  token_file="$tmpdir/token"
  http_config="$tmpdir/http-config.yml"

  vault kv get -field="$vault_field" "$vault_path" >"$token_file"
  chmod 600 "$token_file"

  printf 'authorization:\n  type: Bearer\n  credentials_file: %s\n' "$token_file" >"$http_config"
  chmod 600 "$http_config"

  promtool query instant --http.config.file="$http_config" "$server" "$*"
)