#!/bin/bash
#
# _create_folder_fedora.sh — Create a new folder in /var/www/html with correct permissions (Fedora)
# Invoked via create_folder.sh; not meant to be run directly.
#
# This script must be run as root (su).
#

set -euo pipefail

# ── Colors for output ─────────────────────────────────────────────────────
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# ── Check for root privileges ─────────────────────────────────────────────
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}ERROR: This script must be run as root (su / sudo).${NC}" >&2
    exit 1
fi

# ── Check for mandatory parameter ─────────────────────────────────────────
if [[ $# -lt 1 || -z "$1" ]]; then
    echo -e "${RED}ERROR: Folder name is a mandatory parameter.${NC}" >&2
    echo -e "Usage: $0 <foldername>" >&2
    exit 1
fi

FOLDER_NAME="$1"
BASE_DIR="/var/www/html"
NEW_FOLDER="$BASE_DIR/$FOLDER_NAME"

# Check if target already exists
if [[ -e "$NEW_FOLDER" ]]; then
    echo -e "${RED}ERROR: Target path '$NEW_FOLDER' already exists.${NC}" >&2
    exit 1
fi

# ── Determine regular user ────────────────────────────────────────────────
REGULAR_USER=""
if [[ -n "${SUDO_USER:-}" ]]; then
    REGULAR_USER="$SUDO_USER"
elif command -v logname &>/dev/null && logname &>/dev/null; then
    REGULAR_USER=$(logname)
fi

# Fallback to the owner of the script directory if needed
if [[ -z "$REGULAR_USER" || "$REGULAR_USER" == "root" ]]; then
    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
    REGULAR_USER=$(stat -c '%U' "$SCRIPT_DIR" 2>/dev/null || echo "")
fi

# Final fallback
if [[ -z "$REGULAR_USER" || "$REGULAR_USER" == "root" ]]; then
    REGULAR_USER=$(awk -F: '$3 >= 1000 && $3 != 65534 {print $1; exit}' /etc/passwd)
fi

# Ensure we found a valid regular user
if [[ -z "$REGULAR_USER" ]]; then
    echo -e "${RED}ERROR: Could not determine a regular user for ownership.${NC}" >&2
    exit 1
fi

# ── Configuration ─────────────────────────────────────────────────────────
APACHE_USER="apache"
APACHE_GROUP="apache"

echo "→ Creating folder: $NEW_FOLDER"
mkdir -p "$NEW_FOLDER"

echo "→ Setting permissions and ownership..."
# Set ownership to regular user (matching the existing script's behavior)
chown -R "$REGULAR_USER:$REGULAR_USER" "$NEW_FOLDER"

# Set base permissions
chmod 0755 "$NEW_FOLDER"

# Set ACLs so both the regular user and Apache can read/write
setfacl -R -m u:"$REGULAR_USER":rwx,u:"$APACHE_USER":rwx "$NEW_FOLDER"
setfacl -R -d -m u:"$REGULAR_USER":rwx,u:"$APACHE_USER":rwx "$NEW_FOLDER"

# Also allow the apache group to access
setfacl -R -m g:"$APACHE_GROUP":r-x "$NEW_FOLDER"
setfacl -R -d -m g:"$APACHE_GROUP":r-x "$NEW_FOLDER"

# ── Configure SELinux permissions ─────────────────────────────────────────
if command -v getenforce &>/dev/null; then
    SELINUX_STATUS=$(getenforce 2>/dev/null || echo "Disabled")
    if [[ "$SELINUX_STATUS" != "Disabled" && "$SELINUX_STATUS" != "Permissive" ]]; then
        echo "→ Configuring SELinux permissions..."
        if command -v semanage &>/dev/null; then
            semanage fcontext -a -t httpd_sys_rw_content_t "$NEW_FOLDER(/.*)?" 2>/dev/null || \
            semanage fcontext -m -t httpd_sys_rw_content_t "$NEW_FOLDER(/.*)?" 2>/dev/null || true
        fi
        restorecon -Rv "$NEW_FOLDER" &>/dev/null || true
    fi
fi

echo -e "${GREEN}✓ Folder '$FOLDER_NAME' created successfully in $BASE_DIR!${NC}"