#!/usr/bin/env bash
# One-time apply of COOP/COEP/CORP headers for the wasm PoA crypto preconditions.
# Run ON 192.168.3.110 as root: ops/apply-wasm-headers.sh  (lighttpd primary, nginx mirror optional).
# Enables SharedArrayBuffer (cross-origin isolation) for WasmPoaSigner; see BUILD-OPS.md section 9.
set -euo pipefail
HERE=$(cd "$(dirname "$0")" && pwd)
REPO=$(cd "$HERE/.." && pwd)
MARKER="kukuri wasm-headers"
LIGHTTPD_CONF=/etc/lighttpd/lighttpd.conf

if [ "$(id -u)" != "0" ]; then
  echo "run as root" >&2
  exit 1
fi

if [ -d /etc/lighttpd ]; then
  if grep -rqs "$MARKER" "$LIGHTTPD_CONF" /etc/lighttpd/conf-enabled/ 2>/dev/null; then
    echo "lighttpd: already applied; refreshing snippet"
    rm -f /etc/lighttpd/conf-enabled/95-wasm-headers.conf
    sed -i "/# $MARKER (added by/,+8d" "$LIGHTTPD_CONF" 2>/dev/null || true
  fi
  if ! grep -rqs "mod_setenv" "$LIGHTTPD_CONF" /etc/lighttpd/conf-enabled/ 2>/dev/null; then
    printf '\nserver.modules += ( "mod_setenv" ) # %s\n' "$MARKER" >> "$LIGHTTPD_CONF"
  fi
  if grep -qs "conf-enabled" "$LIGHTTPD_CONF"; then
    install -m 644 "$REPO/deploy/lighttpd/wasm-headers.conf" /etc/lighttpd/conf-available/95-wasm-headers.conf
    ln -sfn /etc/lighttpd/conf-available/95-wasm-headers.conf /etc/lighttpd/conf-enabled/95-wasm-headers.conf
  else
    printf '\n# %s (added by ops/apply-wasm-headers.sh)\n' "$MARKER" >> "$LIGHTTPD_CONF"
    cat "$REPO/deploy/lighttpd/wasm-headers.conf" >> "$LIGHTTPD_CONF"
  fi
  lighttpd -tt -f "$LIGHTTPD_CONF"
  if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet lighttpd 2>/dev/null; then
    systemctl restart lighttpd
  else
    /etc/init.d/lighttpd restart
  fi
  echo "lighttpd: COOP/COEP/CORP headers applied to /artifact/kukuri/latest/web/"
else
  echo "lighttpd: /etc/lighttpd not found; skipped"
fi

if [ -d /etc/nginx ]; then
  install -m 644 "$REPO/deploy/nginx/wasm-headers.conf" /etc/nginx/wasm-headers.conf
  echo "nginx: snippet at /etc/nginx/wasm-headers.conf - add 'include /etc/nginx/wasm-headers.conf;'"
  echo "       to the server block serving the app, then: nginx -t && systemctl reload nginx"
else
  echo "nginx: /etc/nginx not found; skipped"
fi

echo "--- verify (expect Cross-Origin-Opener-Policy / -Embedder-Policy / -Resource-Policy) ---"
if command -v curl >/dev/null 2>&1; then
  curl -sI http://127.0.0.1/artifact/kukuri/latest/web/ | grep -i "^cross-origin" || {
    echo "header check failed - inspect lighttpd config" >&2
    exit 1
  }
fi