#!/usr/bin/env bash
# Reads the client secret from its mounted file, exports it for the realm import, and execs Keycloak.
#
# The realm artifact carries ${KEYCLOAK_GRAPHQL_SMOKE_CLIENT_SECRET} rather than a value, so the
# secret is never in Git. Passing it as a container `environment:` entry would have put it in the
# rendered Compose config and in `docker inspect`; a file read here keeps it process-local.
set -euo pipefail

SECRET_FILE="/run/secrets/keycloak-graphql-smoke-client-secret"
if [[ ! -r "${SECRET_FILE}" ]]; then
  echo "keycloak entrypoint: ${SECRET_FILE} is not readable." >&2
  echo "  The lane wrapper writes it per run at mode 0600; running this stack by hand needs one too." >&2
  exit 78
fi

KEYCLOAK_GRAPHQL_SMOKE_CLIENT_SECRET="$(cat "${SECRET_FILE}")"
export KEYCLOAK_GRAPHQL_SMOKE_CLIENT_SECRET
if [[ -z "${KEYCLOAK_GRAPHQL_SMOKE_CLIENT_SECRET}" ]]; then
  echo "keycloak entrypoint: the client secret file is empty." >&2
  exit 78
fi

exec /opt/keycloak/bin/kc.sh start-dev --import-realm