#!/bin/sh
# Container entrypoint. Optionally fetches secrets from OpenBao before
# starting the app. Backwards compatible: if OPENBAO_ADDR is unset (e.g. e2e
# container, local dev with a populated .env), the vault step is skipped
# and the process starts with whatever's already in the environment.
#
# When OPENBAO_ADDR is set, OPENBAO_ROLE_ID + OPENBAO_SECRET_ID are required.
# The entrypoint logs in via AppRole, fetches kv/ped-ai/prod, exports each
# key as an env var, and then unsets the auth material before execing the
# real command so the Node process doesn't carry them.

set -eu

if [ -n "${OPENBAO_ADDR:-}" ]; then
  if [ -z "${OPENBAO_ROLE_ID:-}" ] || [ -z "${OPENBAO_SECRET_ID:-}" ]; then
    echo "[entrypoint] FATAL: OPENBAO_ADDR is set but OPENBAO_ROLE_ID or OPENBAO_SECRET_ID is missing." >&2
    exit 1
  fi

  export BAO_ADDR="${OPENBAO_ADDR}"
  echo "[entrypoint] authenticating to OpenBao at ${OPENBAO_ADDR} via AppRole..."

  BAO_TOKEN="$(bao write -field=token auth/approle/login \
      role_id="${OPENBAO_ROLE_ID}" \
      secret_id="${OPENBAO_SECRET_ID}" 2>&1)"
  if [ -z "${BAO_TOKEN}" ] || printf '%s' "${BAO_TOKEN}" | grep -qi error; then
    echo "[entrypoint] FATAL: AppRole authentication failed:" >&2
    echo "${BAO_TOKEN}" >&2
    exit 1
  fi
  export BAO_TOKEN

  SECRET_PATH="${OPENBAO_KV_PATH:-kv/ped-ai/prod}"
  echo "[entrypoint] fetching secrets from ${SECRET_PATH}..."
  SECRET_JSON="$(bao kv get -format=json "${SECRET_PATH}" 2>/dev/null | jq -c '.data.data' 2>/dev/null || true)"
  if [ -z "${SECRET_JSON}" ] || [ "${SECRET_JSON}" = "null" ]; then
    echo "[entrypoint] FATAL: no secrets returned from ${SECRET_PATH}." >&2
    exit 1
  fi

  # Export each key/value as a shell-safe env var.
  # jq's @sh filter single-quote-escapes values so eval is safe.
  eval "$(printf '%s' "${SECRET_JSON}" | jq -r 'to_entries[] | "export \(.key)=\(.value | @sh)"')"

  # Bootstrap credentials are no longer needed in the Node process env.
  unset OPENBAO_ROLE_ID OPENBAO_SECRET_ID BAO_TOKEN

  SECRET_COUNT="$(printf '%s' "${SECRET_JSON}" | jq -r 'keys | length')"
  echo "[entrypoint] ✅ loaded ${SECRET_COUNT} secrets from OpenBao"
else
  echo "[entrypoint] OPENBAO_ADDR not set — using existing environment (legacy .env path)"
fi

exec "$@"