#!/bin/bash
set -euo pipefail

# This wrapper is installed only into the GCP service's root-controlled bind.
# Ignore per-invocation mode and endpoint overrides so a service child cannot
# select the VPS/local backend or a different database credential context.
SCRIPT_PATH=${BASH_SOURCE[0]}
SCRIPT_DIR=${SCRIPT_PATH%/*}
if [ "$SCRIPT_DIR" = "$SCRIPT_PATH" ]; then
  SCRIPT_DIR=.
fi
SCRIPT_DIR="$(cd "$SCRIPT_DIR" && pwd)"
CLOUDSQL_TOOL="$SCRIPT_DIR/cloudsql_memory_tool.py"

for argument in "$@"; do
  case "$argument" in
    --host|--host=*|--port|--port=*|--db|--db=*|--canonical-db|--canonical-db=*|\
    --user|--user=*|--password-secret|--password-secret=*|--project|--project=*|\
    --credential-mode|--credential-mode=*)
      echo "teleo-kb: GCP runtime identity and endpoint overrides are forbidden" >&2
      exit 64
      ;;
  esac
done

if [ ! -x "$CLOUDSQL_TOOL" ]; then
  echo "teleo-kb: reviewed GCP Cloud SQL tool is unavailable" >&2
  exit 69
fi
if [ ! -x /usr/bin/python3 ] || [ ! -x /usr/bin/psql ]; then
  echo "teleo-kb: required GCP runtime dependency is unavailable" >&2
  exit 69
fi

exec /usr/bin/env -i \
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
  LANG=C LC_ALL=C \
  PYTHONNOUSERSITE=1 PYTHONSAFEPATH=1 \
  CLOUDSDK_CONFIG=/usr/local/libexec/livingip/leoclean-kb/gcloud-config \
  PGSSLMODE=verify-ca \
  PGSSLROOTCERT=/usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem \
  TELEO_KB_MODE=cloudsql \
  TELEO_GCP_METADATA_ONLY=1 \
  TELEO_GCP_PROJECT=teleo-501523 \
  TELEO_CLOUDSQL_HOST=10.61.0.3 \
  TELEO_CLOUDSQL_PORT=5432 \
  TELEO_CLOUDSQL_DB=teleo_canonical \
  TELEO_CANONICAL_CLOUDSQL_DB=teleo_canonical \
  TELEO_CLOUDSQL_USER=leoclean_kb_runtime \
  TELEO_CLOUDSQL_PASSWORD_SECRET=gcp-teleo-pgvector-standby-leoclean-kb-runtime-password \
  TELEO_CLOUDSQL_ENABLE_AUDIT_FALLBACK=0 \
  /usr/bin/python3 -I "$CLOUDSQL_TOOL" "$@"