#!/bin/sh
# webcentive - official dependency-free CLI for the Webcentive API (curl only).
# Not an npm, PyPI or Homebrew package. Read every line at https://www.webcentive.com/cli/
#
# Usage:
#   webcentive categories     list news categories (JSON)
#   webcentive news <cat>     today's news for one category, e.g. firewalls (JSON)
#   webcentive version        show the version
#
# Safety: read-only GET requests to https://www.webcentive.com only. It sends no
# personal data, writes no files, needs no root, and never runs anything it downloads.
set -eu

BASE='https://www.webcentive.com'   # fixed on purpose: cannot be pointed at another server
UA='webcentive-cli/1.1 (+https://www.webcentive.com/cli/)'

usage() {
  echo "Usage: webcentive categories | news <cat> | version" >&2
  exit 2
}

# HTTPS only (TLS 1.2+), no redirects, 30 second limit, 2 MB response limit.
get() {
  curl --fail --silent --show-error --proto '=https' --tlsv1.2 \
       --max-redirs 0 --max-time 30 --max-filesize 2000000 \
       -A "$UA" "$BASE$1"
  echo
}

[ $# -ge 1 ] || usage
cmd=$1
shift

case $cmd in
  version)
    echo "webcentive-cli 1.1"
    echo "base $BASE"
    ;;
  categories)
    get /api/v1/categories
    ;;
  news)
    [ $# -eq 1 ] || usage
    cat=$1
    # Only a-z, 0-9 and hyphen, 1-30 characters; anything else is refused.
    case $cat in
      *[!a-z0-9-]*|'') echo "webcentive: invalid cat (use a-z, 0-9 and -)" >&2; exit 2 ;;
    esac
    [ ${#cat} -le 30 ] || { echo "webcentive: cat too long (max 30)" >&2; exit 2; }
    get "/api/v1/news?cat=$cat"
    ;;
  *) usage ;;
esac