#!/bin/sh
set -eu

validate_secret_file() {
  path="$1"
  label="$2"
  if [ -L "$path" ] || [ ! -f "$path" ] || [ ! -r "$path" ]; then
    echo "$label must be a readable regular file, not a symlink: $path" >&2
    exit 2
  fi
  mode=$(stat -c '%a' "$path" 2>/dev/null || stat -f '%Lp' "$path" 2>/dev/null) || {
    echo "cannot inspect permissions for $label: $path" >&2
    exit 2
  }
  if [ $((0$mode & 077)) -ne 0 ]; then
    echo "$label must not be readable or writable by group/other users: $path" >&2
    exit 2
  fi
}

read_secret_file() {
  path="$1"
  label="$2"
  validate_secret_file "$path" "$label"
  value=$(tr -d '\r' <"$path")
  case "$value" in
    *'
'*) echo "$label must contain exactly one line" >&2; exit 2 ;;
  esac
  [ -n "$value" ] || { echo "$label must not be empty" >&2; exit 2; }
  printf '%s' "$value"
}