#!/bin/sh
# FlowAgent MCP entrypoint — non-interactive Azure service-principal login.
#
# Expects three env vars pointing at Docker secret files (Pattern C,
# _FILE convention, provisioned by Woodpecker — never hand-typed):
#   FLOWAGENT_AZURE_CLIENT_ID_FILE
#   FLOWAGENT_AZURE_TENANT_ID_FILE
#   FLOWAGENT_AZURE_CLIENT_SECRET_FILE
#
# On success, execs into the real command (node /app/flowagent/mcp.mjs),
# replacing this shell so mcpo's stdio pipe talks directly to the MCP process.
set -eu

: "${FLOWAGENT_AZURE_CLIENT_ID_FILE:?FLOWAGENT_AZURE_CLIENT_ID_FILE not set}"
: "${FLOWAGENT_AZURE_TENANT_ID_FILE:?FLOWAGENT_AZURE_TENANT_ID_FILE not set}"
: "${FLOWAGENT_AZURE_CLIENT_SECRET_FILE:?FLOWAGENT_AZURE_CLIENT_SECRET_FILE not set}"

CLIENT_ID="$(cat "$FLOWAGENT_AZURE_CLIENT_ID_FILE")"
TENANT_ID="$(cat "$FLOWAGENT_AZURE_TENANT_ID_FILE")"
CLIENT_SECRET="$(cat "$FLOWAGENT_AZURE_CLIENT_SECRET_FILE")"

az login --service-principal \
  -u "$CLIENT_ID" \
  -p "$CLIENT_SECRET" \
  --tenant "$TENANT_ID" \
  --output none

unset CLIENT_SECRET

exec "$@"