#!/bin/sh
set -eu

prepare_runtime_dirs() {
    mkdir -p var/cache/prod/asset_mapper var/log var/data public/uploads

    chown -R www-data:www-data var public/uploads
    chmod -R u+rwX,g+rwX var public/uploads

    # Keep group ownership sticky so subsequent writes inherit www-data group.
    find var public/uploads -type d -exec chmod g+s {} \;
}

require_app_secret() {
    if [ -z "${APP_SECRET:-}" ]; then
        echo "APP_SECRET environment variable is required at runtime" >&2
        exit 1
    fi
}

ensure_jwt_keys() {
    if [ ! -f bin/console ]; then
        return
    fi

    mkdir -p config/jwt

    if [ -f config/jwt/private.pem ] && [ -f config/jwt/public.pem ]; then
        return
    fi

    if [ -z "${JWT_PASSPHRASE:-}" ]; then
        JWT_PASSPHRASE="${APP_SECRET}"
    fi

    openssl genpkey \
        -out config/jwt/private.pem \
        -algorithm rsa \
        -pkeyopt rsa_keygen_bits:4096 \
        -aes-256-cbc \
        -pass pass:"${JWT_PASSPHRASE}"

    openssl pkey \
        -in config/jwt/private.pem \
        -passin pass:"${JWT_PASSPHRASE}" \
        -pubout \
        -out config/jwt/public.pem

    chmod 600 config/jwt/private.pem
    chmod 644 config/jwt/public.pem
    chown -R www-data:www-data config/jwt
}

install_runtime() {
    if [ -f vendor/autoload_runtime.php ] && [ "${FORCE_COMPOSER_INSTALL:-0}" != "1" ]; then
        return
    fi

    echo "Installing Composer dependencies..."
    su-exec www-data composer install \
        --no-dev \
        --prefer-dist \
        --no-interaction \
        --no-progress
}

install_runtime

if [ -f bin/console ]; then
    require_app_secret
    ensure_jwt_keys
    prepare_runtime_dirs
fi

if [ "${RUN_MIGRATIONS_ON_START:-1}" = "1" ] && [ -f bin/console ]; then
    if [ "${DATABASE_DRIVER:-sqlite}" = "sqlite" ]; then
        SQLITE_PATH="${DATABASE_SQLITE_PATH:-/var/www/html/var/data/database.sqlite}"
        SQLITE_DIR=$(dirname "${SQLITE_PATH}")
        mkdir -p "${SQLITE_DIR}"
        if [ ! -f "${SQLITE_PATH}" ]; then
            touch "${SQLITE_PATH}"
        fi
        chown -R www-data:www-data "${SQLITE_DIR}"
    fi

    su-exec www-data php bin/console doctrine:migrations:migrate --no-interaction --allow-no-migration
fi

if [ -f bin/console ]; then
    su-exec www-data php bin/console app:sync-external-provider --no-interaction
fi

if [ -f bin/console ]; then
    su-exec www-data php bin/console cache:clear --no-warmup
    su-exec www-data php bin/console cache:warmup
    prepare_runtime_dirs
fi

exec "$@"