From 583d499b2c42cca336d187928924545a40c6f680 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Mon, 7 Sep 2026 09:16:52 -0500
Subject: [PATCH] nuisance: creds chain env > sm vault > legacy file

sm re-auth pending (#925); /tmp/cr.env is the documented interim.

Redmine: https://projects.knownelement.com/issues/925
---
 perf/nuisance/nuisance-sweep.sh | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/perf/nuisance/nuisance-sweep.sh b/perf/nuisance/nuisance-sweep.sh
index 4cb87ff..e80b4d4 100644
--- a/perf/nuisance/nuisance-sweep.sh
+++ b/perf/nuisance/nuisance-sweep.sh
@@ -47,16 +47,32 @@ timeout 120 env VM_IP="$HOST_NAME" VM_USER=root bash tests/remote.sh vm \
 deny_lines=$(wc -l < "$TMP/scan")
 
 # --- 2. current blocklist from the Cloudron API ---
-# Creds: pre-exported env (e.g. `sm env cloudron`) wins; ~/.creds fallback is
-# legacy (the textfile pattern was RETIRED 2026-09-06 — vault via sm is the way).
+# Creds precedence: pre-exported env → TSGCOO vault via `sm` (sanctioned path,
+# needs a live sm session) → ~/.creds legacy file (textfiles RETIRED 2026-09-06;
+# /tmp/cr.env is the documented interim until sm is re-authed).
 if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ]; then
-    [ -f "$HOME/.creds/cloudron.env" ] || fail "no CLOUDRON_URL/CLOUDRON_API_TOKEN in env and $HOME/.creds/cloudron.env missing"
+    if command -v sudo >/dev/null 2>&1; then
+        eval "$(sudo -n -u TSGCOO /data2/TSGCOO/.local/bin/sm env cloudron 2>/dev/null)" || true
+    fi
+fi
+if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ] && [ -f /tmp/cr.env ]; then
+    set -a
+    # interim token file, documented above
+    # shellcheck disable=SC1091
+    . /tmp/cr.env
+    set +a
+    export CLOUDRON_URL="${CLOUDRON_URL:-https://my.knownelement.com}"
+fi
+if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ]; then
+    [ -f "$HOME/.creds/cloudron.env" ] || fail "no Cloudron creds: env empty, sm unavailable, /tmp/cr.env and ~/.creds/cloudron.env missing"
     set -a
     # shellcheck disable=SC1091  # creds file path built above
     . "$HOME/.creds/cloudron.env"
     set +a
 fi
-[ -n "${CLOUDRON_URL:-}" ] && [ -n "${CLOUDRON_API_TOKEN:-}" ] || fail "creds file lacks CLOUDRON_URL/CLOUDRON_API_TOKEN"
+if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ]; then
+    fail "no CLOUDRON_URL/CLOUDRON_API_TOKEN from any source"
+fi
 curl -sf --max-time 15 "$CLOUDRON_URL/api/v1/network/blocklist" \
     -H "Authorization: Bearer $CLOUDRON_API_TOKEN" \
     | jq -r .blocklist > "$TMP/current" || fail "blocklist GET failed"