#!/bin/sh
# Idempotent MinIO bootstrap: bucket + per-app service account scoped to that
# bucket. Re-running just refreshes the policy and resets the access key.
set -eu

mc alias set local http://minio:9000 "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}"

ensure_bucket() {
  bucket="$1"
  if ! mc ls "local/${bucket}" >/dev/null 2>&1; then
    mc mb "local/${bucket}"
  fi
  mc anonymous set none "local/${bucket}" >/dev/null
}

write_policy() {
  name="$1"
  bucket="$2"
  cat > "/tmp/${name}.json" <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": ["arn:aws:s3:::${bucket}"]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": ["arn:aws:s3:::${bucket}/*"]
    }
  ]
}
EOF
  mc admin policy create local "${name}" "/tmp/${name}.json" 2>/dev/null \
    || mc admin policy update local "${name}" "/tmp/${name}.json"
}

ensure_user() {
  access="$1"
  secret="$2"
  policy="$3"
  if mc admin user info local "${access}" >/dev/null 2>&1; then
    # Rotate secret to match desired state.
    mc admin user remove local "${access}" >/dev/null
  fi
  mc admin user add local "${access}" "${secret}"
  mc admin policy attach local "${policy}" --user "${access}" 2>/dev/null || true
}

ensure_bucket "asxpio-invoices"
write_policy  "asxpio-invoices-rw" "asxpio-invoices"
ensure_user   "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw"

echo "minio-init: done"