#!/bin/bash
# bot-card "<item title>" <field>    e.g. bot-card "Company Card" number
# Reads one card field from a 1Password vault that only this helper can reach. The vault's service-account token
# lives in the macOS Keychain with no trusted apps, so macOS asks you to approve every single read.
set -euo pipefail
item="${1:?item title}"; field="${2:?field (number, expiry, cvv, cardholder, zip)}"
case "$field" in number) f=ccnum;; cvv|code) f=cvv;; expiry|exp) f=expiry;; cardholder|name) f=cardholder;; *) f="$field";; esac
tok="$(security find-generic-password -s "Bot payments 1Password token" -w 2>/dev/null)" || {
  echo "The card request was not approved on the Mac. Ask your person in chat, then try again." >&2; exit 2; }
OP_SERVICE_ACCOUNT_TOKEN="$tok" op item get "$item" --vault "Bot Payments" --fields "$f" --reveal