#!/bin/sh
# {{ ansible_managed }}
#
# 1Password CLI shim for the Multica daemon user (multica_agent_host role,
# WDWL-37). Reads the service account token from a 0600 file and exports it
# to {{ multica_op_binary }} only, so it never sits in an agent's shell
# environment.
token_file="{{ multica_op_token_file }}"

if [ ! -r "$token_file" ]; then
    echo "op: no 1Password service account token at $token_file" >&2
    exit 78
fi
IFS= read -r OP_SERVICE_ACCOUNT_TOKEN < "$token_file"
if [ -z "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
    echo "op: 1Password service account token file $token_file is empty" >&2
    exit 78
fi
export OP_SERVICE_ACCOUNT_TOKEN

# `op run` (and `op plugin run`) hand their own environment, token included,
# to the command they start. Find the subcommand, skipping global flags that
# take a value, and stop at the first `--`.
sub1=""; sub2=""; skip=0; help=0
for a in "$@"; do
    if [ "$skip" = 1 ]; then skip=0; continue; fi
    case "$a" in
        --) break ;;
        -h|--help) help=1 ;;
        --account|--config|--encoding|--format|--session) skip=1 ;;
        -*) ;;
        *) if [ -z "$sub1" ]; then sub1=$a; elif [ -z "$sub2" ]; then sub2=$a; fi ;;
    esac
done

if [ "$sub1" = run ] || { [ "$sub1" = plugin ] && [ "$sub2" = run ]; }; then
    # Rebuild the arguments with `env -u` spliced in after the first `--`, so
    # the child starts without the token.
    n=$#; i=0; spliced=0
    while [ "$i" -lt "$n" ]; do
        a=$1; shift
        set -- "$@" "$a"
        if [ "$spliced" = 0 ] && [ "$a" = "--" ]; then
            set -- "$@" /usr/bin/env -u OP_SERVICE_ACCOUNT_TOKEN
            spliced=1
        fi
        i=$((i + 1))
    done
    if [ "$spliced" = 0 ] && [ "$help" = 0 ]; then
        echo "op: use 'op run [flags] -- <command>'; the shim needs the '--' to keep the service account token out of <command>" >&2
        exit 64
    fi
fi

exec "{{ multica_op_binary }}" "$@"