#!/usr/bin/env bash
# root-fix-tooling-perms.sh — make _crossfeed/tooling uniformly group-writable
# (collaboration across agent accounts) while keeping credentials/ locked down.
# Usage: sudo bash ~/.coordinate/scripts/root-fix-tooling-perms.sh
set -euo pipefail
[ "$(id -u)" -eq 0 ] || { echo "ERROR: run with sudo"; exit 1; }

T=/home/_crossfeed/tooling
[ -d "$T" ] || { echo "ERROR: $T missing"; exit 1; }

chgrp -R users "$T"
# group rw, but NEVER widen credentials/ (skip symlinks; dangling links OK)
find "$T" -path "$T/credentials" -prune -o ! -type l -print0 | xargs -0 -r chmod g+rwX || true
find "$T" -path "$T/credentials" -prune -o -type d -print0 | xargs -0 -r chmod g+s || true
# lock credentials to owner only
chgrp -R reachableceo "$T/credentials" 2>/dev/null || true
chmod -R o-rwx,g-rwx "$T/credentials" || true

echo "OK: tooling group-writable (setgid dirs), credentials owner-only"