#!/bin/sh
set -eu

image=${SANTET_IMAGE:-santet-devsecops:local}
target=${SANTET_TARGET_DIR:-$PWD}

target=$(CDPATH= cd -- "$target" && pwd)

socket=${SANTET_DOCKER_SOCKET:-}
if [ -z "$socket" ]; then
  if [ -S /var/run/docker.sock ]; then
    socket=/var/run/docker.sock
  else
    endpoint=$(docker context inspect --format '{{.Endpoints.docker.Host}}' 2>/dev/null || true)
    case "$endpoint" in
      unix://*) socket=${endpoint#unix://} ;;
      *) socket=/var/run/docker.sock ;;
    esac
  fi
fi

if [ ! -S "$socket" ]; then
  echo "Docker socket not found: $socket" >&2
  echo "Set SANTET_DOCKER_SOCKET to the active Unix socket." >&2
  exit 2
fi

run_uid=$(id -u)
run_gid=$(id -g)
socket_gid=$(stat -Lc '%g' "$socket" 2>/dev/null || stat -L -f '%g' "$socket")
daemon_os=$(docker info --format '{{.OperatingSystem}}' 2>/dev/null || true)
case "$daemon_os" in
  *Docker\ Desktop*) socket_gid=0 ;;
esac

credential_dir=${SANTET_CLOUD_CREDENTIAL_DIR:-}
if [ -n "$credential_dir" ]; then
  case "$credential_dir" in
    /*) ;;
    *) echo "SANTET_CLOUD_CREDENTIAL_DIR must be an absolute path." >&2; exit 2 ;;
  esac
  [ -d "$credential_dir" ] || {
    echo "Cloud credential directory not found: $credential_dir" >&2
    exit 2
  }
fi

if [ -n "$credential_dir" ]; then
  set -- -v "$credential_dir:$credential_dir:ro" "$image" "$@"
else
  set -- "$image" "$@"
fi

exec docker run --rm \
  --user "$run_uid:$run_gid" \
  --group-add "$socket_gid" \
  --security-opt=no-new-privileges \
  --cap-drop=ALL \
  -e HOME=/tmp \
  -e SANTET_TARGET_DIR="$target" \
  -e SANTET_HOST_HOME="${HOME:-}" \
  -e SANTET_DOCKER_WRAPPER=true \
  -e IMAGE -e PROJECT_NAME -e PROJECT_VERSION -e K8S_PATHS \
  -e TRIVY_EXIT_CODE -e TRIVY_SEVERITY \
  -e SANTET_CLOUD_CREDENTIAL_DIR \
  -e SANTET_CLOUD_TARGET -e SANTET_CLOUD_SEVERITIES \
  -e SANTET_CLOUD_REGIONS -e SANTET_CLOUD_SERVICES \
  -e SANTET_CLOUD_CHECKS -e SANTET_CLOUD_COMPLIANCE \
  -e SANTET_CLOUD_ALLOW_METADATA \
  -e SANTET_PROWLER_IMAGE \
  -e SANTET_AWS_PROFILE -e SANTET_AWS_ROLE_ARN -e SANTET_AWS_EXTERNAL_ID \
  -e SANTET_AZURE_AUTH -e SANTET_AZURE_SUBSCRIPTION_IDS -e SANTET_AZURE_REGION \
  -e SANTET_GCP_ORGANIZATION_ID -e SANTET_GCP_PROJECT_IDS \
  -e SANTET_ALIBABA_ROLE_ARN -e SANTET_ALIBABA_OIDC_ROLE_ARN \
  -e SANTET_ALIBABA_ECS_RAM_ROLE \
  -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN \
  -e AWS_PROFILE -e AWS_REGION -e AWS_DEFAULT_REGION -e AWS_ROLE_ARN \
  -e AWS_WEB_IDENTITY_TOKEN_FILE -e AWS_ROLE_SESSION_NAME \
  -e AWS_CONTAINER_CREDENTIALS_RELATIVE_URI -e AWS_CONTAINER_CREDENTIALS_FULL_URI \
  -e AWS_CONTAINER_AUTHORIZATION_TOKEN -e AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE \
  -e AZURE_CLIENT_ID -e AZURE_TENANT_ID -e AZURE_CLIENT_SECRET \
  -e AZURE_FEDERATED_TOKEN_FILE -e AZURE_CLIENT_CERTIFICATE_PATH \
  -e AZURE_CLIENT_CERTIFICATE_PASSWORD -e IDENTITY_ENDPOINT -e IDENTITY_HEADER \
  -e MSI_ENDPOINT -e MSI_SECRET \
  -e GOOGLE_APPLICATION_CREDENTIALS -e GOOGLE_IMPERSONATE_SERVICE_ACCOUNT \
  -e CLOUDSDK_AUTH_ACCESS_TOKEN \
  -e ALIBABA_CLOUD_ACCESS_KEY_ID -e ALIBABA_CLOUD_ACCESS_KEY_SECRET \
  -e ALIBABA_CLOUD_SECURITY_TOKEN -e ALIBABA_CLOUD_ROLE_ARN \
  -e ALIBABA_CLOUD_OIDC_PROVIDER_ARN -e ALIBABA_CLOUD_OIDC_TOKEN_FILE \
  -e ALIBABA_CLOUD_ECS_METADATA -e ALIBABA_CLOUD_CREDENTIALS_URI \
  -e DOCKER_HOST=unix:///var/run/docker.sock \
  -v "$socket:/var/run/docker.sock" \
  -v "$target:$target" \
  -w "$target" \
  "$@"
