#!/usr/bin/env bash
set -euo pipefail
IMAGE='ghcr.io/berriai/litellm:main-stable@sha256:3d88bd757134a00e8c00237b85a021ab1f6d54abb9c1df750f411dbe7256a500'
case "${1:-}" in
  codex)
    CODE='from litellm.llms.chatgpt.authenticator import Authenticator; Authenticator().get_access_token(); print("Codex login complete")'
    ;;
  xai)
    CODE='from litellm.llms.xai.oauth import XAIOAuthAuthenticator; XAIOAuthAuthenticator().login(no_browser=True); print("xAI login complete")'
    ;;
  *) printf 'Usage: bash oauth-login.sh codex|xai\n' >&2; exit 2 ;;
esac
# The helper shares only the proxy token volume, not its API keys or database.
sudo docker run --rm -it --network host \
  --mount type=volume,src=tools-litellm-oauth,dst=/tokens \
  -e CHATGPT_TOKEN_DIR=/tokens/chatgpt -e XAI_OAUTH_TOKEN_DIR=/tokens/xai \
  --entrypoint python "$IMAGE" -c "$CODE"
printf 'Login persisted. Verify model IDs, then restart only the litellm service.\n'