Replace an organization key

curl --fail-with-body \
  --header "Authorization: Bearer $MILLWORK_API_KEY" \
  "$MILLWORK_API_URL/api-keys" \
  | jq '.api_keys[] | {
      api_key_id,
      display_name,
      key_prefix,
      status,
      created_at
    }'

export OLD_API_KEY_ID="<ID for the key you are replacing>"

umask 077

if ! curl --fail-with-body \
  --request POST \
  --header "Authorization: Bearer $MILLWORK_API_KEY" \
  --output new-key.json \
  "$MILLWORK_API_URL/api-keys"; then
  echo "The replacement was not confirmed created. Read new-key.json before continuing." >&2
  exit 1
fi

NEW_MILLWORK_API_KEY="$(jq -er '.key' new-key.json)" || exit 1
export NEW_MILLWORK_API_KEY

if ! curl --fail-with-body \
  --header "Authorization: Bearer $NEW_MILLWORK_API_KEY" \
  "$MILLWORK_API_URL/model-catalog" > /dev/null; then
  echo "The new key did not pass its check. Keep the old key in use." >&2
  exit 1
fi

if ! curl --fail-with-body \
  --request POST \
  --header "Authorization: Bearer $NEW_MILLWORK_API_KEY" \
  "$MILLWORK_API_URL/api-keys/$OLD_API_KEY_ID/revoke"; then
  echo "Revocation was not confirmed. Check the old key's status before continuing." >&2
  exit 1
fi

if ! OLD_KEY_STATUS="$(
  curl --silent --show-error \
    --output /dev/null \
    --write-out "%{http_code}" \
    --header "Authorization: Bearer $MILLWORK_API_KEY" \
    "$MILLWORK_API_URL/model-catalog"
)"; then
  echo "The old key could not be checked. Keep both key records and try the check again." >&2
  exit 1
fi

if ! test "$OLD_KEY_STATUS" = "401"; then
  echo "The old key did not return 401. Confirm revocation before continuing." >&2
  exit 1
fi

rm -f new-key.json
unset NEW_MILLWORK_API_KEY
echo "Key replacement confirmed."