#!/bin/bash
# Agent communication capability layer initialization script
# Sets up the ACL tmpfs key directory. The dispatcher mounts
# /opt/harness/bin/acl-finalize directly (AC-2).

set -euo pipefail

echo "Initializing agent-communication capability layer..."

# Create tmpfs for ACL key material (AC-7: noexec,nosuid,mode=0700)
ACL_KEY_DIR="/run/agent/acl"
mkdir -p "${ACL_KEY_DIR}"
mount -t tmpfs -o noexec,nosuid,mode=0700 tmpfs "${ACL_KEY_DIR}"

# Write Ed25519 private key from env to tmpfs (AC-7: mode 0600)
if [[ -n "${AGENT_ED25519_KEY:-}" ]]; then
    printf '%s' "${AGENT_ED25519_KEY}" > "${ACL_KEY_DIR}/ed25519.key"
    chmod 0600 "${ACL_KEY_DIR}/ed25519.key"
    unset AGENT_ED25519_KEY
fi

# Write Ed25519 public key from env to tmpfs (mode 0644)
if [[ -n "${AGENT_ED25519_PUB:-}" ]]; then
    printf '%s' "${AGENT_ED25519_PUB}" > "${ACL_KEY_DIR}/ed25519.pub"
    chmod 0644 "${ACL_KEY_DIR}/ed25519.pub"
    unset AGENT_ED25519_PUB
fi

# Write mTLS cert and key from env to tmpfs (AC-8)
if [[ -n "${AGENT_MTLS_CERT:-}" ]]; then
    printf '%s' "${AGENT_MTLS_CERT}" > "${ACL_KEY_DIR}/mtls.crt"
    chmod 0600 "${ACL_KEY_DIR}/mtls.crt"
    unset AGENT_MTLS_CERT
fi

if [[ -n "${AGENT_MTLS_KEY:-}" ]]; then
    printf '%s' "${AGENT_MTLS_KEY}" > "${ACL_KEY_DIR}/mtls.key"
    chmod 0600 "${ACL_KEY_DIR}/mtls.key"
    unset AGENT_MTLS_KEY
fi

# Ensure /opt/harness/bin/ exists (dispatcher mounts acl-finalize here)
mkdir -p /opt/harness/bin

echo "Agent communication environment ready"