#!/usr/bin/env bash
set -euo pipefail

usage() {
  echo "Usage: ladill-hosting-user <username> <base64-command>" >&2
  exit 64
}

[[ $# -eq 2 ]] || usage

username="$1"
payload_b64="$2"

if [[ ! "$username" =~ ^[A-Za-z_][A-Za-z0-9_-]*$ ]]; then
  echo "Invalid username: $username" >&2
  exit 64
fi

command="$(printf '%s' "$payload_b64" | base64 --decode)"

exec runuser -u "$username" -- bash -lc "$command"