#!/usr/bin/env nix-shell
#!nix-shell -i bash -p bash -p gnused -p sops

# browserpass "validates" the gpg binary by invoking it with --version
if [ "$1" = "--version" ]
then
  echo "sops-gpg-adapter 0.1";
  exit 0
fi

# using exec here forwards our stdin
# browserpass parses the response in
# <browserpass-extension/src/background.js#parseFields>
# it cares about `key:value`, and ignores whatever doesn't fit that (or has an unknown key)
# browserpass understands the `totp` field to hold either secret tokens, or full URLs.
# i use totp-b32 for the base-32-encoded secrets. renaming that field works OOTB.
exec sops --input-type yaml -d --output-type yaml --config /dev/null /dev/stdin | sed s/\^totp-b32:/totp:/