#!/usr/bin/env bash
set -euo pipefail

# Regression: the wrapper accepts only an operation name and never places a
# plaintext credential on a Docker/Compose command line.
script="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)/provision-machine-credential.sh"
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/bin" "$tmp/repo/deploy"
cp "$script" "$tmp/repo/deploy/provision-machine-credential.sh"
printf 'placeholder\n' > "$tmp/repo/deploy/docker-compose.prod.yml"
printf 'placeholder\n' > "$tmp/env"
cat > "$tmp/bin/docker" <<'SH'
#!/usr/bin/env bash
printf '%s\n' "$*" >> "${CAPTURE:?}"
SH
cat > "$tmp/bin/git" <<'SH'
#!/usr/bin/env bash
printf '0123456789abcdef0123456789abcdef01234567\n'
SH
chmod +x "$tmp/bin/docker" "$tmp/bin/git" "$tmp/repo/deploy/provision-machine-credential.sh"
capture="$tmp/capture"
PATH="$tmp/bin:$PATH" CAPTURE="$capture" REPO_DIR="$tmp/repo" ENV_FILE="$tmp/env" "$tmp/repo/deploy/provision-machine-credential.sh" ensure >/dev/null
grep -qx 'volume create assistant_control_plane_service_secrets' "$capture"
grep -q -- '--profile secret-control-plane run --rm --no-deps secret-control-plane ensure' "$capture"
PATH="$tmp/bin:$PATH" CAPTURE="$capture" REPO_DIR="$tmp/repo" ENV_FILE="$tmp/env" ROTATION_REASON=owner-requested-rotation "$tmp/repo/deploy/provision-machine-credential.sh" rotate >/dev/null
grep -q -- '--profile secret-control-plane run --rm --no-deps secret-control-plane -reason owner-requested-rotation rotate' "$capture"
if grep -Eqi '(token=|password=|secret=|authorization:)' "$capture"; then
  echo "provisioning wrapper passed credential material" >&2
  exit 1
fi