#!/usr/bin/env bash
set -euo pipefail

: "${CI_SPIFFE_ID:?CI_SPIFFE_ID is required}"
: "${SPIFFE_ENDPOINT_SOCKET:?SPIFFE_ENDPOINT_SOCKET is required}"

socket_path=${SPIFFE_ENDPOINT_SOCKET#unix://}
deadline=$((SECONDS + 120))
while (( SECONDS < deadline )); do
  if /opt/spire/bin/spire-agent api fetch x509 \
    -socketPath "$socket_path" \
    -output json 2>/dev/null | \
    jq -e --arg id "$CI_SPIFFE_ID" \
      'any(.svids[]?; .spiffe_id == $id)' >/dev/null; then
    exec /usr/local/bin/run.sh
  fi
  sleep 1
done

printf 'timed out waiting for OpenSandbox SPIFFE identity %s\n' "$CI_SPIFFE_ID" >&2
exit 1