#!/bin/bash
# cp-service-token init — restage the ESO-mounted secret to an agent-owned
# copy.
#
# Threat model: keep the ESO mount root-only (mode 0400) so the agent user
# cannot directly `cat` /run/agent/secrets/cp-service-token/*. init.sh runs
# as root (in uid-wrapper.sh, before the gosu drop) and writes a restaged
# copy at /run/agent/cp-service-token/token with mode 0600 owned by the
# agent user. This mirrors anthropic-cloud-paul-oauth/v1/init.sh's pattern.
#
# Bug discovered live 2026-09-03: without this restaging step, cp-cli
# (invoked by the agent user, uid 1000) could not read the raw 0400
# root-owned mount at all — "cp_cli invocation can't proceed... token is
# root-owned mode 0400 so it's not readable by the agent user". The context
# originally set CP_SERVICE_TOKEN_FILE directly at the raw ESO mount path,
# which is the mistake this init.sh fixes.

set -euo pipefail

ESO_TOKEN="/run/agent/secrets/cp-service-token/value"

if [ ! -r "$ESO_TOKEN" ]; then
    echo "ERROR: $ESO_TOKEN not readable. Check ESO ExternalSecret acct-1d963673." >&2
    exit 1
fi

AGENT_USER="${AGENT_USER:-agent}"

DEST_DIR="/run/agent/cp-service-token"
mkdir -p "$DEST_DIR"

DEST_FILE="$DEST_DIR/token"
cp "$ESO_TOKEN" "$DEST_FILE"

chown "$AGENT_USER:" "$DEST_DIR" "$DEST_FILE" 2>/dev/null || true
chmod 0700 "$DEST_DIR"
chmod 0600 "$DEST_FILE"

echo "cp-service-token: restaged into $DEST_FILE (0600 $AGENT_USER:$AGENT_USER)"