#!/usr/bin/env bash
# Git credential helper backed by the 1Password CLI.
#
# Scoped to specific hosts via credential.<url>.helper in ~/.gitconfig
# (see home/dot_gitconfig.tmpl) -- this script itself never sees a URL,
# it just answers with whatever OP_REF points at for the invoking host.
#
# Fields are read live from 1Password on every git operation, so no
# secret ever touches disk.
set -euo pipefail

op_ref="${GIT_CREDENTIAL_OP_REF:?GIT_CREDENTIAL_OP_REF must be set by the caller}"

case "${1:-}" in
  get)
    cat >/dev/null
    echo "username=$(op read "${op_ref}/username")"
    echo "password=$(op read "${op_ref}/password")"
    ;;
  store|erase)
    cat >/dev/null
    ;;
  *)
    exit 1
    ;;
esac