#!/bin/bash
set -euo pipefail

# Normalize permissions required by TMS standard CISD initialization.
# Run as root after the standard receiver media has been placed under /home/cmep4i.

STANDARD_HOME_DIR="${STANDARD_HOME_DIR:-/home/cmep4i}"
STANDARD_RUN_USER="${STANDARD_RUN_USER:-cmep4i}"
TMS_RUN_USER="${TMS_RUN_USER:-tms}"

if [ "$(id -u)" != "0" ]; then
    echo "this script must be executed as root" >&2
    exit 77
fi

id "${STANDARD_RUN_USER}" >/dev/null 2>&1 || {
    echo "standard run user not found: ${STANDARD_RUN_USER}" >&2
    exit 66
}

id "${TMS_RUN_USER}" >/dev/null 2>&1 || {
    echo "tms run user not found: ${TMS_RUN_USER}" >&2
    exit 66
}

require_dir() {
    local dir="$1"
    if [ ! -d "${dir}" ]; then
        echo "required directory not found: ${dir}" >&2
        exit 66
    fi
}

apply_acl() {
    local path="$1"
    if command -v setfacl >/dev/null 2>&1; then
        setfacl -R -m "u:${STANDARD_RUN_USER}:rwX,u:${TMS_RUN_USER}:rX" "${path}"
        find "${path}" -type d -exec setfacl -m "d:u:${STANDARD_RUN_USER}:rwX,d:u:${TMS_RUN_USER}:rX" {} +
    else
        echo "setfacl not found; falling back to group-readable mode only" >&2
        chmod -R g+rX "${path}"
    fi
}

standard_media="${STANDARD_HOME_DIR}/cpackage"
require_dir "${standard_media}"

chown -R "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${standard_media}"
chmod -R u+rwX,go-rwx "${standard_media}"
apply_acl "${standard_media}"

if [ -d "${standard_media}/toolsh" ]; then
    find "${standard_media}/toolsh" -type f -name "*.sh" -exec chmod 750 {} +
fi

if [ -d "${standard_media}/rabq" ]; then
    find "${standard_media}/rabq" -type f -name "*.sh" -exec chmod 750 {} +
    find "${standard_media}/rabq" -type f -name "rabbitmqadmin" -exec chmod 755 {} +
fi

for config in \
    "${standard_media}/cmsp/01/application-prd-ci01.properties" \
    "${standard_media}/cmsp/02/application-prd-ci02.properties" \
    "${standard_media}/cmtp/01/application-prd-ci01.properties" \
    "${standard_media}/cmtp/02/application-prd-ci02.properties"
do
    if [ -f "${config}" ]; then
        chown "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${config}"
        chmod 640 "${config}"
        if command -v setfacl >/dev/null 2>&1; then
            setfacl -m "u:${STANDARD_RUN_USER}:rw,u:${TMS_RUN_USER}:r" "${config}"
        fi
    else
        echo "warning: standard template config not found: ${config}" >&2
    fi
done

for dir in \
    "${STANDARD_HOME_DIR}/cmsp" \
    "${STANDARD_HOME_DIR}/cmtp" \
    "${STANDARD_HOME_DIR}/cmep/license" \
    "${STANDARD_HOME_DIR}/mysql/loadfilepath"
do
    mkdir -p "${dir}"
    chown -R "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${dir}"
    chmod 750 "${dir}"
    if command -v setfacl >/dev/null 2>&1; then
        setfacl -m "u:${STANDARD_RUN_USER}:rwx,u:${TMS_RUN_USER}:rwx" "${dir}"
        setfacl -m "d:u:${STANDARD_RUN_USER}:rwX,d:u:${TMS_RUN_USER}:rwX" "${dir}"
    fi
done

if [ -f "${STANDARD_HOME_DIR}/cpconfig.cfg" ]; then
    chown "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${STANDARD_HOME_DIR}/cpconfig.cfg"
    chmod 640 "${STANDARD_HOME_DIR}/cpconfig.cfg"
else
    touch "${STANDARD_HOME_DIR}/cpconfig.cfg"
    chown "${STANDARD_RUN_USER}:${STANDARD_RUN_USER}" "${STANDARD_HOME_DIR}/cpconfig.cfg"
    chmod 640 "${STANDARD_HOME_DIR}/cpconfig.cfg"
fi

if command -v setfacl >/dev/null 2>&1; then
    setfacl -m "u:${STANDARD_RUN_USER}:rw,u:${TMS_RUN_USER}:rw" "${STANDARD_HOME_DIR}/cpconfig.cfg"
fi

echo "standard permissions prepared under ${STANDARD_HOME_DIR}"