#!/bin/sh
set -eu

project_id=${INFISICAL_PROJECT_ID:?INFISICAL_PROJECT_ID is required}
environment=${INFISICAL_ENVIRONMENT:?INFISICAL_ENVIRONMENT is required}
runtime_scope=${INFISICAL_RUNTIME_SCOPE:?INFISICAL_RUNTIME_SCOPE is required}
client_id_file=${INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE:?INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE is required}
client_secret_file=${INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE:?INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE is required}
build_number=${SHD_BUILD_NUMBER:-0}
commit_sha=${SHD_COMMIT_SHA:-}
secret_file=
shared_secret_file=

cleanup() {
	if [ -n "$secret_file" ]; then rm -f "$secret_file"; fi
	if [ -n "$shared_secret_file" ]; then rm -f "$shared_secret_file"; fi
}

trap cleanup EXIT
trap 'exit 129' HUP
trap 'exit 130' INT
trap 'exit 143' TERM

if [ ! -r "$client_id_file" ] || [ ! -r "$client_secret_file" ]; then
	echo "Infisical Universal Auth credential files are not readable." >&2
	exit 1
fi

if [ "$(id -u)" -eq 0 ]; then
	runtime_uid=$(id -u shd-runtime)
	for credential_file in "$client_id_file" "$client_secret_file"; do
		credential_uid=$(stat -c '%u' "$credential_file")
		credential_mode=$(stat -c '%a' "$credential_file")
		if [ "$credential_uid" -eq "$runtime_uid" ] || [ $((credential_mode % 100)) -ne 0 ]; then
			echo "Infisical credential files must not be readable by the application runtime user." >&2
			exit 1
		fi
	done
	if [ "$runtime_scope" = app ] && ! { [ "${1:-}" = node ] && [ "${2:-}" = scripts/validate-runtime-environment.mjs ]; }; then
		chgrp -R node /app/data
		chmod -R g+rwX /app/data
	fi
fi

client_id=$(cat "$client_id_file")
client_secret=$(cat "$client_secret_file")
if [ -z "$client_id" ] || [ -z "$client_secret" ]; then
	echo "Infisical Universal Auth credential files must not be empty." >&2
	exit 1
fi

unset INFISICAL_TOKEN INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN TOKEN
access_token=$(
	INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$client_id" \
		INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$client_secret" \
		infisical login --method=universal-auth --silent --plain
)
unset client_id client_secret

if [ -z "$access_token" ]; then
	echo "Infisical Universal Auth returned an empty access token." >&2
	exit 1
fi

umask 077
secret_file=$(mktemp /tmp/shd-infisical-app.XXXXXX)

case "$runtime_scope" in
	app)
		INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
			--projectId="$project_id" \
			--env="$environment" \
			--path=/app \
			--format=json \
			--output-file="$secret_file" \
			--silent
		shared_secret_file=$(mktemp /tmp/shd-infisical-shared.XXXXXX)
		INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
			--projectId="$project_id" \
			--env="$environment" \
			--path=/shared/scheduler \
			--format=json \
			--output-file="$shared_secret_file" \
			--silent
		;;
	scheduler)
		INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
			--projectId="$project_id" \
			--env="$environment" \
			--path=/shared/scheduler \
			--format=json \
			--output-file="$secret_file" \
			--silent
		;;
	*)
		echo "Unsupported INFISICAL_RUNTIME_SCOPE: $runtime_scope" >&2
		exit 2
		;;
esac

unset access_token \
	INFISICAL_TOKEN \
	INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN \
	INFISICAL_UNIVERSAL_AUTH_CLIENT_ID \
	INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET

if [ "$runtime_scope" = app ]; then
	if [ "$(id -u)" -eq 0 ]; then
		chown shd-runtime:node "$secret_file" "$shared_secret_file"
		exec gosu shd-runtime node scripts/runtime-launcher.mjs app "$environment" "$build_number" "$commit_sha" "$secret_file" "$shared_secret_file" -- "$@"
	fi
	exec node scripts/runtime-launcher.mjs app "$environment" "$build_number" "$commit_sha" "$secret_file" "$shared_secret_file" -- "$@"
fi
if [ "$(id -u)" -eq 0 ]; then
	chown shd-runtime:node "$secret_file"
	exec gosu shd-runtime node scripts/runtime-launcher.mjs scheduler "$environment" "$build_number" "$commit_sha" "$secret_file" -- "$@"
fi
exec node scripts/runtime-launcher.mjs scheduler "$environment" "$build_number" "$commit_sha" "$secret_file" -- "$@"