#!/bin/bash

###############################################################################
# cPGuard X WP-CLI Wrapper Script
# 
# Purpose: Execute WP-CLI using user-specific configurations from cPGuard X
# - Only for managed users (not root)
# - Reads user's configured PHP binary from ~/.cpguard/php.ini
# - Uses cPGuard PHP wrapper to execute WP-CLI
# - Enforces open_basedir restrictions
###############################################################################

set -euo pipefail

# Color codes for output
RED='\033[0;31m'
BLUE='\033[0;34m'
BOLD='\033[1m'
NC='\033[0m'

# Configuration paths
CPGUARD_ROOT="/opt/cpguard/app"
CPGUARD_RESOURCES="${CPGUARD_ROOT}/resources/tools"
PHP_SCRIPT="${CPGUARD_ROOT}/scripts/php"
WPCLI_PHAR="${CPGUARD_RESOURCES}/wp-cli"

# Get current user and home directory
CURRENT_USER="$(id -un)"
USER_HOME="$(eval echo "~$CURRENT_USER")"
CURRENT_DIR="$(pwd -P)"

# User's cPGuard config
CPGUARD_USER_CONFIG="$USER_HOME/.cpguard/php.ini"

# Export HOME for subprocesses
export HOME="$USER_HOME"

###############################################################################
# Function: Print error message and exit
###############################################################################
error_exit() {
    local message="$1"
    local exit_code="${2:-1}"
    echo -e "${RED}cPGuard X Error: ${message}${NC}" >&2
    exit "$exit_code"
}

###############################################################################
# Function: Validate required files
###############################################################################
validate_environment() {
    # WP-CLI only for managed users (not root)
    if [ "$CURRENT_USER" = "root" ]; then
        error_exit "WP-CLI is only for managed users. Please switch to the website user first."
    fi

    # Check WP-CLI PHAR exists
    if [ ! -f "$WPCLI_PHAR" ]; then
        error_exit "WP-CLI not found at $WPCLI_PHAR"
    fi

    # Check PHP wrapper script exists
    if [ ! -f "$PHP_SCRIPT" ]; then
        error_exit "PHP wrapper not found at $PHP_SCRIPT"
    fi

    # Check user PHP config exists
    if [ ! -f "$CPGUARD_USER_CONFIG" ]; then
        error_exit "PHP configuration not found for user '$CURRENT_USER'"
    fi
}

###############################################################################
# Function: Extract open_basedir from user config
###############################################################################
get_open_basedir() {
    local open_basedir
    
    open_basedir=$(grep -E "^[[:space:]]*open_basedir[[:space:]]*=" "$CPGUARD_USER_CONFIG" 2>/dev/null | tail -n 1 | cut -d'=' -f2- | xargs || true)
    
    if [ -z "$open_basedir" ]; then
        error_exit "open_basedir not configured in $CPGUARD_USER_CONFIG"
    fi

    echo "$open_basedir"
}

###############################################################################
# Function: Validate current directory against open_basedir
###############################################################################
validate_current_directory() {
    local open_basedir="$1"
    local allowed=0

    # Split by colon and check each allowed directory
    IFS=':' read -ra BASEDIRS <<< "$open_basedir"
    for dir in "${BASEDIRS[@]}"; do
        # Remove trailing slash for consistent comparison
        dir="${dir%/}"
        [ -z "$dir" ] && continue

        # Check if current directory matches or is under allowed directory
        if [ "$CURRENT_DIR" = "$dir" ] || [[ "$CURRENT_DIR" == "$dir"/* ]]; then
            allowed=1
            break
        fi
    done

    if [ "$allowed" -ne 1 ]; then
        error_exit "Access denied from $CURRENT_DIR. Allowed: $open_basedir"
    fi
}

###############################################################################
# Main Execution
###############################################################################

# Validate environment
validate_environment

# Get open_basedir restrictions
OPEN_BASEDIR=$(get_open_basedir)

# Validate current working directory
validate_current_directory "$OPEN_BASEDIR"

# Construct open_basedir with additional paths for WP-CLI
WPCLI_OPEN_BASEDIR="${OPEN_BASEDIR}:${CPGUARD_RESOURCES}:/opt:/tmp:/dev:/proc"

# Execute WP-CLI via PHP wrapper with open_basedir
exec "$PHP_SCRIPT" \
    -c "$CPGUARD_USER_CONFIG" \
    -d "open_basedir=${WPCLI_OPEN_BASEDIR}" \
    "$WPCLI_PHAR" "$@"