#!/bin/bash

###############################################################################
# cPGuard X Composer Wrapper Script
# 
# Purpose: Execute Composer using user-specific configurations from cPGuard X
# - For managed users: Use configured PHP from ~/.cpguard/php.ini
# - For unmanaged users: Use greatest available PHP from /opt/cpguard/packages/
# - Uses cPGuard PHP wrapper to execute composer
# - Enforces open_basedir restrictions for managed users
# - Sets up composer-specific directories and environment
###############################################################################

set -euo pipefail

# Color codes for output
RED='\033[0;31m'
BLUE='\033[0;34m'
BOLD='\033[1m'
NC='\033[0m'

# Configuration paths
CPGUARD_ROOT="/opt/cpguard/app"
CPGUARD_RESOURCES="${CPGUARD_ROOT}/resources/tools"
PHP_SCRIPT="${CPGUARD_ROOT}/scripts/php"
COMPOSER_PHAR="${CPGUARD_RESOURCES}/composer"

# Get current user and home directory
CURRENT_USER="$(id -un)"
USER_HOME="$(eval echo "~$CURRENT_USER")"
CURRENT_DIR="$(pwd -P)"

# User's cPGuard config
CPGUARD_USER_CONFIG="$USER_HOME/.cpguard/php.ini"

# Export HOME for subprocesses
export HOME="$USER_HOME"

###############################################################################
# Function: Print error message and exit
###############################################################################
error_exit() {
    local message="$1"
    local exit_code="${2:-1}"
    echo -e "${RED}cPGuard X Error: ${message}${NC}" >&2
    exit "$exit_code"
}

###############################################################################
# Function: Validate required files
###############################################################################
validate_environment() {
    # Check composer.phar exists
    if [ ! -f "$COMPOSER_PHAR" ]; then
        error_exit "Composer not found at $COMPOSER_PHAR"
    fi

    # Check PHP wrapper script exists
    if [ ! -f "$PHP_SCRIPT" ]; then
        error_exit "PHP wrapper not found at $PHP_SCRIPT"
    fi
}

###############################################################################
# Function: Check if user is managed by cPGuard X
###############################################################################
is_cpguard_managed_user() {
    if [ -f "$CPGUARD_USER_CONFIG" ]; then
        return 0
    fi
    return 1
}

###############################################################################
# Function: Extract open_basedir from user config
###############################################################################
get_open_basedir() {
    local open_basedir
    
    open_basedir=$(grep -E "^[[:space:]]*open_basedir[[:space:]]*=" "$CPGUARD_USER_CONFIG" 2>/dev/null | tail -n 1 | cut -d'=' -f2- | xargs || true)
    
    if [ -z "$open_basedir" ]; then
        error_exit "open_basedir not configured in $CPGUARD_USER_CONFIG"
    fi

    echo "$open_basedir"
}

###############################################################################
# Function: Validate current directory against open_basedir
###############################################################################
validate_current_directory() {
    local open_basedir="$1"
    local allowed=0

    # Split by colon and check each allowed directory
    IFS=':' read -ra BASEDIRS <<< "$open_basedir"
    for dir in "${BASEDIRS[@]}"; do
        # Remove trailing slash for consistent comparison
        dir="${dir%/}"
        [ -z "$dir" ] && continue

        # Check if current directory matches or is under allowed directory
        if [ "$CURRENT_DIR" = "$dir" ] || [[ "$CURRENT_DIR" == "$dir"/* ]]; then
            allowed=1
            break
        fi
    done

    if [ "$allowed" -ne 1 ]; then
        error_exit "Access denied from $CURRENT_DIR. Allowed: $open_basedir"
    fi
}

###############################################################################
# Function: Setup composer-specific directories
###############################################################################
setup_composer_directories() {
    local cpguard_dir="$USER_HOME/.cpguard"
    
    # Create composer subdirectories
    mkdir -p "$USER_HOME/.composer" \
             "$USER_HOME/.composer/cache"

    # Set appropriate permissions
    chmod 700 "$USER_HOME/.composer" 2>/dev/null || true
}

###############################################################################
# Main Execution
###############################################################################

# Validate environment
validate_environment

# Define composer data directory
CPGUARD_USER_DATA="$USER_HOME/.cpguard"

# Check if user is managed by cPGuard X
if is_cpguard_managed_user; then
    # Managed user: validate restrictions and config
    
    # Get open_basedir restrictions
    OPEN_BASEDIR=$(get_open_basedir)
    
    # Validate current working directory
    validate_current_directory "$OPEN_BASEDIR"
    
    # Setup composer directories
    setup_composer_directories
    
    # Construct open_basedir with additional paths for composer
    COMPOSER_OPEN_BASEDIR="${OPEN_BASEDIR}:${CPGUARD_RESOURCES}:${CPGUARD_USER_DATA}:/opt:/tmp:/dev:/proc"
    
    # Setup environment variables for composer
    export COMPOSER_HOME="$USER_HOME/.composer"
    export COMPOSER_CACHE_DIR="$USER_HOME/.composer/cache"
    
    # Execute composer via PHP wrapper with open_basedir
    exec "$PHP_SCRIPT" \
        -c "$CPGUARD_USER_CONFIG" \
        -d "open_basedir=${COMPOSER_OPEN_BASEDIR}" \
        "$COMPOSER_PHAR" "$@"
else
    # Unmanaged user: run without restrictions (like root)
    
    # Setup composer directories (best effort)
    setup_composer_directories 2>/dev/null || true
    
    # Setup environment variables for composer
    export COMPOSER_HOME="$USER_HOME/.composer"
    export COMPOSER_CACHE_DIR="$USER_HOME/.composer/cache"
    
    # Execute composer via PHP wrapper without restrictions
    exec "$PHP_SCRIPT" "$COMPOSER_PHAR" "$@"
fi