#!/usr/bin/env bash
# cd 到 backend-web 根目录后: bash scripts/setup-backend-perms.sh [soonModels路径]
set -eu

ROOT="$(cd "${1:-.}" && pwd)"
MODELS="${2:-}"
U="${WEB_USER:-www}"
G="${WEB_GROUP:-www}"

[[ -d "$ROOT/public" && -d "$ROOT/src" ]] || { echo "错误: 请先 cd 到 backend-web"; exit 1; }
id "$U" &>/dev/null || { echo "错误: 用户 $U 不存在"; exit 1; }

mkdir -p "$ROOT/storage"/{users,logs,payment,cache/rate,cache/wechat_certs}
chown -R "$U:$G" "$ROOT"
find "$ROOT/src" "$ROOT/public" -type d -exec chmod 755 {} +
find "$ROOT/src" "$ROOT/public" -type f -exec chmod 644 {} +
chmod 755 "$ROOT/config"
[[ -f "$ROOT/config/local.php" ]] && chmod 640 "$ROOT/config/local.php"
chmod 775 "$ROOT/storage/users" "$ROOT/storage/logs" "$ROOT/storage/cache/rate" "$ROOT/storage/cache/wechat_certs"
chmod 700 "$ROOT/storage/payment"
rm -f "$ROOT/storage/cache/rate/"*.json 2>/dev/null || true

if [[ -n "$MODELS" ]]; then
  mkdir -p "$MODELS"
  chown -R "$U:$G" "$MODELS"
  chmod 755 "$MODELS"
fi

for d in "$ROOT/storage/users" "$ROOT/storage/logs" "$ROOT/storage/payment"; do
  sudo -u "$U" test -w "$d" || { echo "FAIL: $d"; exit 1; }
done

echo OK