#!/bin/sh
set -eu

# Docker named volumes are normally created as root:root. Older Neural Hunt
# worker versions could also leave identity.json owned by a different UID.
# Normalize only the dedicated identity mount and the fixed identity file, then
# permanently drop to the unprivileged app user before the Go client starts.
if [ "$(id -u)" = "0" ]; then
    if [ -L /identity/identity.json ]; then
        echo "refusing symlink at /identity/identity.json" >&2
        exit 1
    fi

    chown app:app /identity
    if [ -e /identity/identity.json ]; then
        chown app:app /identity/identity.json
    fi

    exec su-exec app:app /app/neuralhunt-client "$@"
fi

exec /app/neuralhunt-client "$@"