`approve`

63 lines
#!/usr/bin/env bash
# TK-11340 readiness entry point. User authorization is already recorded.
# This checks prerequisites; it does not purchase a proxy or deploy the cutover.
set -euo pipefail

if [[ $# -ne 1 || "$1" != "ungate" ]]; then
  echo 'Usage: bash approve ungate' >&2
  exit 64
fi

cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
echo 'TK-11340: cutover approval recorded; checking prerequisites.'
node --check scripts/check-live.js

# Read configuration as data, never source an env file or print its values.
node <<'NODE'
const fs = require('node:fs');
const path = require('node:path');
const os = require('node:os');

function readProxy(file) {
  let data;
  try { data = fs.readFileSync(file, 'utf8'); }
  catch (error) {
    if (error.code === 'ENOENT') return '';
    console.error('BLOCKED: unable to read proxy configuration; details suppressed.');
    process.exit(2);
  }
  for (const line of data.split(/\r?\n/)) {
    const match = line.match(/^\s*(?:export\s+)?PROXY_URL\s*=\s*(.*?)\s*$/);
    if (!match) continue;
    let value = match[1];
    if ((value.startsWith('"') && value.endsWith('"')) ||
        (value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
    if (value) return value;
  }
  return '';
}

const proxy = process.env.PROXY_URL || readProxy(path.resolve('.env')) ||
  readProxy(path.join(os.homedir(), 'Projects', 'secrets-manager', '.env'));

if (!proxy) {
  console.error('BLOCKED: PROXY_URL is missing from the process, project, and master registry.');
  console.error('Needed: approved proxy endpoint credentials, routed through the secrets skill.');
  console.error('No production or Mac push settings were changed.');
  process.exit(2);
}

try {
  const url = new URL(proxy);
  if (!['http:', 'https:'].includes(url.protocol) || !url.hostname) throw new Error();
} catch {
  console.error('BLOCKED: PROXY_URL is not a valid HTTP(S) proxy URL; value suppressed.');
  process.exit(2);
}

console.log('Proxy configuration found. Credentials have not yet been tested.');
console.log('NEXT: run the real Kamatera proxy canary, then the authorized cutover in');
console.log('verification/TK-11340-cutover.md. This readiness command does not deploy.');
process.exit(3);
NODE