#!/usr/bin/env bash
set -euo pipefail

# Safe diagnostics only: artifact existence/readability and mount topology.
# This script never reads or prints credential content.
TOKEN_PATH="/run/control-plane-secrets/control_plane_service_token"
VOLUME="assistant_control_plane_service_secrets"
authorized=(assistant-core-runtime-1 assistant-commit-runtime-1)
unauthorized=(assistant-creator-web-1 assistant-cognitive-worker-1 assistant-research-runtime-1 assistant-continuity-runtime-1 assistant-agent-worker-1)

for container in "${authorized[@]}"; do
  docker inspect "$container" >/dev/null
  docker exec "$container" sh -c "test -r '$TOKEN_PATH'"
  docker inspect -f '{{range .Mounts}}{{if eq .Name "assistant_control_plane_service_secrets"}}{{.Destination}} {{.RW}}{{end}}{{end}}' "$container" | grep -qx '/run/control-plane-secrets false'
done

for container in "${unauthorized[@]}"; do
  docker inspect "$container" >/dev/null
  if docker inspect -f '{{range .Mounts}}{{println .Name}}{{end}}' "$container" | grep -qx "$VOLUME"; then
    echo "unauthorized runtime has the control-plane credential mount" >&2
    exit 1
  fi
done

echo "machine credential mount topology verified"