#!/bin/sh
set -eu

[ "$(id -u)" = "0" ] || { echo "FAIL must_run_as_root"; exit 1; }

config=/root/.xtao-secret-agent/config.env
[ -r "$config" ] || { echo "FAIL missing_config"; exit 2; }
. "$config"

master=/root/.xtao-secret-agent/master.key
shared=${XTAO_SECRET_AGENT_SHARED:-/volume1/xtao-data/secret-agent}
db=${XTAO_SECRET_AGENT_DB:-/root/.xtao-secret-agent/db/xtao-automation.kdbx}
image=${XTAO_SECRET_AGENT_PY_IMAGE:-python@sha256:cab2dbf575e971934a81e4622f5aba17aa7929719bd7e31033a3a83b97fd0464}
backup=${XTAO_SECRET_AGENT_BACKUP:-/volume2/xtao-backup/secret-agent/kdbx}
db_dir=$(dirname "$db")
db_name=$(basename "$db")
site="$shared/runtime/site"
wheels="$shared/runtime/wheels"
runner="$shared/bin/secret_agent_runner.py"
lock=/root/.xtao-secret-agent/locks/agent.lock

[ -s "$master" ] || { echo "FAIL missing_unlock_input"; exit 2; }
[ -s "$db" ] || { echo "FAIL missing_kdbx"; exit 2; }
[ -r "$runner" ] || { echo "FAIL missing_runner"; exit 2; }
mkdir -p "$site" "$backup" "$(dirname "$lock")"
chmod 700 "$shared" "$shared/runtime" "$shared/bin" "$backup" "$(dirname "$lock")"

ensure_runtime() {
  if [ -f "$site/pykeepass/__init__.py" ]; then
    return 0
  fi
  [ -d "$wheels" ] || { echo "FAIL missing_wheels"; exit 2; }
  /usr/local/bin/docker run --rm --network none \
    -v "$wheels:/wheels:ro" \
    -v "$site:/site" \
    "$image" \
    python -m pip install --root-user-action ignore --no-index --find-links /wheels --target /site pykeepass >/dev/null
  [ -f "$site/pykeepass/__init__.py" ] || { echo "FAIL runtime_install"; exit 2; }
}

ensure_runtime

cmd=${1:-probe}
shift || true

exec 9>"$lock"
flock -x 9
cat "$master" | /usr/local/bin/docker run --rm -i --network none \
  -v "$db_dir:/kdbx" \
  -v "$backup:/backup" \
  -v "$site:/site:ro" \
  -v "$runner:/runner/secret_agent_runner.py:ro" \
  -e PYTHONPATH=/site \
  "$image" \
  python /runner/secret_agent_runner.py --db "/kdbx/$db_name" --backup-dir /backup "$cmd" "$@"