#!/bin/bash
# airouter init — Phase 9 ESO-managed secret mount.
#
# Verifies the ESO-mounted secret files exist; the wrapper
# (`bin/anthropic-compat-wrapper.sh`) reads them at exec time.
#
# Per H-SECRET-4: NO `export` of credentials here. The earlier draft of this
# file exported ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL from this script,
# which runs as root under uid-wrapper.sh — even though the export was
# subshell-scoped, the secret was briefly resident in /proc/<pid>/environ of
# a root process. The wrapper's `exec env VAR=...` pattern is the only
# acceptable credential delivery point.
set -euo pipefail

SECRETS_DIR="/run/agent/secrets/airouter"

if [ ! -d "$SECRETS_DIR" ]; then
    echo "ERROR: Secret directory $SECRETS_DIR not found. ESO mount may have failed." >&2
    exit 1
fi

for f in auth_token base_url; do
    if [ ! -r "$SECRETS_DIR/$f" ]; then
        echo "ERROR: $SECRETS_DIR/$f not readable. Check ESO ExternalSecret for airouter." >&2
        exit 1
    fi
done

echo "airouter secrets verified at $SECRETS_DIR"