# refresh_tokens.sh
# Run in the current Bash shell: source ./refresh_tokens.sh
nsis_refresh_tokens() {
    if [[ -z "${REFRESH_TOKEN:-}" ]]; then
        printf '%s\n' 'No refresh token is set. Run source ./authenticate.sh first.' >&2
        return 1
    fi
    local nsis_response nsis_access nsis_refresh
    nsis_response=$(curl --fail --silent --show-error \
        'https://identity.nsiscloud.polsa.gov.pl/auth/realms/NSIS-Cloud/protocol/openid-connect/token' \
        --data-urlencode 'client_id=nsis-public' \
        --data-urlencode 'grant_type=refresh_token' \
        --data-urlencode "refresh_token=$REFRESH_TOKEN") || return 1
    nsis_access=$(jq -er '.access_token | select(type == "string" and length > 0)' <<< "$nsis_response") || return 1
    nsis_refresh=$(jq -er '.refresh_token | select(type == "string" and length > 0)' <<< "$nsis_response") || return 1
    export ACCESS_TOKEN="$nsis_access" REFRESH_TOKEN="$nsis_refresh"
    printf '%s\n' 'NSIS tokens refreshed in this shell.'
}
nsis_refresh_tokens