#!/usr/bin/env bash
set -euo pipefail

root="$(git rev-parse --show-toplevel)"
auth_bridge="$root/internal/api/ags/auth_bridge.go"
server="$root/internal/resource/server/server.go"
internal_request="$root/internal/agsbridge/internal_request.go"

fail() {
  echo "AGS internal identity boundary: $1" >&2
  exit 1
}

rg -q 'const WorkloadSubject = "meshx-internal"' "$internal_request" ||
  fail "shared MeshX workload subject must remain owned by agsbridge"

rg -q 'agsbridge.AuthorizationHeader\(\)' "$server" ||
  fail "server-owned AGS clients must share agsbridge.AuthorizationHeader"

if rg -n 'agentteam-automation-eventer|AutomationEventerPrincipalID' "$auth_bridge" "$server"; then
  fail "Automation actor attribution must not participate in AGS authentication wiring"
fi

if rg -n 'InternalSubject|InternalIdentity' "$auth_bridge"; then
  fail "AgentTeamAuthenticator must not remap the shared workload subject to another AGS identity"
fi

echo "AGS internal identity boundary passed."