#!/bin/sh
# Keep this executable LF-only: CRLF corrupts the Linux shebang.
set -eu
umask 077

required="MESSAGE_SAFETY_DATABASE_URL_FILE"
case "${MESSAGE_SAFETY_PROCESS_ROLE:-api}" in
  api) required="$required MESSAGE_SAFETY_SERVICE_TOKEN_FILE" ;;
  worker)
    required="$required
SELECTEL_S3_QUARANTINE_READ_ACCESS_KEY_FILE
SELECTEL_S3_QUARANTINE_READ_SECRET_KEY_FILE"
    ;;
  *) echo "invalid MESSAGE_SAFETY_PROCESS_ROLE" >&2; exit 78 ;;
esac
for name in $required; do
  eval "path=\${$name:-}"
  if [ -z "$path" ] || [ ! -r "$path" ] || [ ! -s "$path" ]; then
    echo "required secret file is unavailable: $name" >&2
    exit 78
  fi
done

exec "$@"