Token rotation

[Carltoffel]

If you are using 2FA, you're probably using tokens for pass-git-helper.
Since tokens have a limited lifetime, you'll have to generate new tokens at least every year.
I wrote a little helper, that automatically rotates (extends) a token.
The current token is read out from pass and gets replaced with the new token.
If the pass entry contains multiple lines, such as the username, they will remain unchanged.

This program is not perfect, so use it at your own risk and adjust it to your situation.

#!/bin/bash

# Configuration variables
PASS_ENTRY="gitlab-token"
GITLAB_API_URL="https://gitlab.com/api/v4"

# Read the current token from pass
CURRENT_PASS_ENTRY=$(pass show $PASS_ENTRY)
# Assumes the first line to be the token
CURRENT_TOKEN=$(echo "$CURRENT_PASS_ENTRY" | head -n 1)

# Curl command to rotate the token
RESPONSE=$(curl --silent --request POST \
  --header "PRIVATE-TOKEN: $CURRENT_TOKEN" \
  "$GITLAB_API_URL/personal_access_tokens/self/rotate" \
  --data "expires_at=$(date --date 'next year')")

# Check Curl status
if [ $? -ne 0 ]; then
  echo "Error during Curl command."
  exit 1
fi

# Extract the new token from the response
TOKEN_EXPIRES=$(echo "$RESPONSE" | jq -r '.expires_at')
NEW_TOKEN=$(echo "$RESPONSE" | jq -r '.token')

# Check if a new token was successfully retrieved
if [ "$NEW_TOKEN" != "null" ] && [ -n "$NEW_TOKEN" ]; then
  # Update the entry in pass with the new token
  echo -e "$NEW_TOKEN\n$(echo "$CURRENT_PASS_ENTRY" | sed '1d')"| pass insert -m --force "$PASS_ENTRY"
  echo "The token has been successfully rotated and is valid until $TOKEN_EXPIRES."
else
  echo "Error: The token could not be rotated."
  echo -e "Response from the API:\n$RESPONSE"
fi