#!/bin/bash
# Run a command inside the WireGuard VPN network namespace.
# Usage: vpn-exec <command> [args...]
#
# The namespace auto-starts if not already running.
# Multiple sessions can use this concurrently without conflicts.
#
# DATA GOVERNANCE: Refuses to run unless the session is using AWS Bedrock.
# The bot sets CLAUDE_SESSION_PROVIDER in the Claude process environment.
set -euo pipefail

# Enforce Bedrock requirement for client data access
if [ "${CLAUDE_SESSION_PROVIDER:-}" != "bedrock" ]; then
  echo "ERROR: VPN access requires AWS Bedrock provider for client data governance." >&2
  echo "Switch to Bedrock first with: provider bedrock" >&2
  exit 1
fi

NS="ns-gemma"

# Auto-start namespace if not running
if ! ip netns list 2>/dev/null | grep -q "^${NS}"; then
  sudo /usr/local/bin/vpn-ns up
fi

if [ $# -eq 0 ]; then
  echo "Usage: vpn-exec <command> [args...]" >&2
  exit 1
fi

CALLER=$(whoami)
exec sudo /usr/bin/ip netns exec "$NS" runuser -u "$CALLER" -- "$@"