#!/bin/sh
# 启动安全检查: 只打印警告, 不中断启动
WARN=0
warn() { echo "[security] WARN: $1"; WARN=$((WARN+1)); }
ok()   { echo "[security] OK:   $1"; }

TOKEN="${OPENCLAW_GATEWAY_TOKEN:-}"
if [ -z "$TOKEN" ]; then
  warn "OPENCLAW_GATEWAY_TOKEN 未设置 - 将沿用旧配置里的令牌(不推荐)"
elif [ "${#TOKEN}" -lt 32 ]; then
  warn "OPENCLAW_GATEWAY_TOKEN 只有 ${#TOKEN} 位 - 现在登录只靠它, 请换成 32 位以上的字母数字"
elif ! printf '%s' "$TOKEN" | grep -Eq '^[A-Za-z0-9]+$'; then
  warn "OPENCLAW_GATEWAY_TOKEN 含特殊字符 - 建议只用字母数字"
else
  ok "网关令牌长度 ${#TOKEN}, 字母数字"
fi

if [ -n "${HF_TOKEN:-}" ] && [ "$HF_TOKEN" = "$TOKEN" ]; then
  warn "OPENCLAW_GATEWAY_TOKEN 与 HF_TOKEN 相同 - 请分开"
fi

CONFIG="${OPENCLAW_HOME:-/home/user}/.openclaw/openclaw.json"
[ -f "$CONFIG" ] && ok "openclaw.json 权限: $(stat -c %a "$CONFIG" 2>/dev/null || echo unknown)"
echo "[security] 检查完成: $WARN 条警告"
exit 0