#!/usr/bin/env bash
set -euo pipefail

script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
repo_root="$(cd "${script_dir}/.." && pwd)"
source "${script_dir}/lib-compose-project.sh"

mode="nossl"
env_file="${repo_root}/.env.devprod"

usage() {
  cat <<USAGE
Usage: ./scripts/ensure-nextcloud-apps-writable.sh [options]

Ensures /var/www/html/apps, /var/www/html/custom_apps,
/var/www/html/config, and /var/www/html/data are writable by the
Nextcloud web user inside the app container.

Options:
  --mode ssl|nossl        Compose mode (default: nossl)
  --ssl                   Alias for --mode ssl
  --nossl                 Alias for --mode nossl
  --env-file <path>       Env file to use (default: .env.devprod)
  -h, --help              Show this help
USAGE
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --mode)
      mode="${2:-}"
      shift 2
      ;;
    --mode=*)
      mode="${1#*=}"
      shift
      ;;
    --ssl)
      mode="ssl"
      shift
      ;;
    --nossl)
      mode="nossl"
      shift
      ;;
    --env-file)
      env_file="${2:-}"
      shift 2
      ;;
    --env-file=*)
      env_file="${1#*=}"
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "Unknown option: $1"
      usage
      exit 1
      ;;
  esac
done

if [[ "${mode}" != "ssl" && "${mode}" != "nossl" ]]; then
  echo "Invalid mode: ${mode}"
  exit 1
fi

if [[ "${env_file}" != /* ]]; then
  env_file="${repo_root}/${env_file}"
fi
if [[ ! -f "${env_file}" ]]; then
  echo "Missing env file: ${env_file}"
  exit 1
fi

export_compose_project_name_from_env "${env_file}" || true

compose_file="${repo_root}/docker-compose.devprod.nossl.yml"
if [[ "${mode}" == "ssl" ]]; then
  compose_file="${repo_root}/docker-compose.devprod.yml"
fi

root_fix_failed="0"
if ! docker compose -f "${compose_file}" --env-file "${env_file}" exec -u root -T app sh -lc '
  set -eu
  mkdir -p /var/www/html/apps /var/www/html/custom_apps /var/www/html/config /var/www/html/data
  printf "%s\n" "# Nextcloud data directory" > /var/www/html/data/.ncdata
  chown -R 33:33 /var/www/html/apps /var/www/html/custom_apps /var/www/html/config /var/www/html/data
  chmod -R u+rwX,g+rwX /var/www/html/apps /var/www/html/custom_apps /var/www/html/config /var/www/html/data
' >/dev/null 2>&1; then
  root_fix_failed="1"
fi

if ! docker compose -f "${compose_file}" --env-file "${env_file}" exec -u 33 -T app sh -lc '
  set -eu
  touch /var/www/html/apps/.permtest
  rm -f /var/www/html/apps/.permtest
  touch /var/www/html/custom_apps/.permtest
  rm -f /var/www/html/custom_apps/.permtest
  touch /var/www/html/config/.permtest
  rm -f /var/www/html/config/.permtest
  test -f /var/www/html/data/.ncdata
  touch /var/www/html/data/.permtest
  rm -f /var/www/html/data/.permtest
' >/dev/null 2>&1; then
  echo "Failed to enforce write permissions on /var/www/html/apps, /var/www/html/custom_apps, /var/www/html/config, and /var/www/html/data."
  echo "Run manually as root inside app container:"
  echo "  mkdir -p /var/www/html/apps /var/www/html/custom_apps /var/www/html/config /var/www/html/data"
  echo "  printf '%s\n' '# Nextcloud data directory' > /var/www/html/data/.ncdata"
  echo "  chown -R 33:33 /var/www/html/apps /var/www/html/custom_apps /var/www/html/config /var/www/html/data"
  echo "  chmod -R u+rwX,g+rwX /var/www/html/apps /var/www/html/custom_apps /var/www/html/config /var/www/html/data"
  exit 1
fi

if [[ "${root_fix_failed}" == "1" ]]; then
  echo "Warning: root-level ownership repair could not run, but Nextcloud apps/config directories are writable."
fi

echo "Nextcloud apps/config/data directories are writable."