#!/bin/bash
# airouter init — Phase 9 ESO-managed secret + agentic-runner staging.
#
# The airouter ESO ExternalSecret materialises a single key, `api_key`,
# matching the airouter provider schema. The previous version of this
# script verified `auth_token` + `base_url` (Anthropic-compat shape, dead
# code per the M22 Phase 9 cleanup) and never matched a real ESO Secret.
#
# Threat model: ESO mount is root-only (mode 0400) — agent CANNOT read
# /run/agent/secrets/airouter/api_key directly. init.sh runs as root
# (under uid-wrapper.sh, before the gosu drop) and installs a per-agent
# copy of the api_key at a fixed path the agentic runner reads via
# OPENAI_API_KEY_FILE. Same pattern as minimax/v1/init.sh.
#
# Per H-SECRET-4: no `export` of the credential value here — the staged
# file path is referenced from harness env (OPENAI_API_KEY_FILE), and the
# agentic runner reads the file at request time.
set -euo pipefail

ESO_API_KEY="/run/agent/secrets/airouter/api_key"

if [ ! -r "$ESO_API_KEY" ]; then
    echo "ERROR: $ESO_API_KEY not readable. Check ESO ExternalSecret acct-<airouter-id>." >&2
    exit 1
fi

AGENT_USER="${AGENT_USER:-agent}"

# Stage to a fixed path that harness.yaml env can reference. Outside the
# read-only ESO mount so we can set ownership/mode.
STAGED_DIR="/var/agent-secrets/airouter"
STAGED_KEY="$STAGED_DIR/api_key"
mkdir -p "$STAGED_DIR"
chown "$AGENT_USER:" "$STAGED_DIR" 2>/dev/null || true
chmod 0700 "$STAGED_DIR"
install -m 0600 -o "$AGENT_USER" -g "$AGENT_USER" "$ESO_API_KEY" "$STAGED_KEY"

echo "airouter api_key staged at $STAGED_KEY (0600 $AGENT_USER:$AGENT_USER)"
echo "airouter OPENAI_API_KEY_FILE set via harness.yaml env"