#!/bin/bash
set -euo pipefail
if [[ "$(id -u)" != "0" ]]; then echo 'Run as root (sudo bash badge-admin/install.sh)'; exit 1; fi
FILE=/var/www/html/badges/badges.json
if [[ ! -f "$FILE" ]]; then echo "ERROR: $FILE does not exist yet"; exit 1; fi
if ! php -r 'json_decode(file_get_contents($argv[1]),true,32,JSON_THROW_ON_ERROR);' "$FILE"; then
  echo 'ERROR: badges.json is invalid; not changing permissions.'; exit 1
fi
mkdir -p /etc/zixdash /var/lib/zixdash
chown root:www-data /var/lib/zixdash
chmod 770 /var/lib/zixdash
chmod 750 /etc/zixdash
chown root:www-data /etc/zixdash
cp -n "$FILE" /etc/zixdash/badges.initial-backup.json || true
chown root:www-data "$FILE"
chmod 664 "$FILE"
chmod 644 /var/www/html/badge-admin/api.php
KEYFILE=/etc/zixdash/badge-manager.sha256
if [[ -f "$KEYFILE" && "${1:-}" != '--rotate' ]]; then
  echo 'Already paired. If you lost the original key, run:'
  echo '  sudo bash /var/www/html/badge-admin/install.sh --rotate'
  exit 0
fi
TOKEN=$(php -r 'echo bin2hex(random_bytes(32));')
printf '%s' "$TOKEN" | sha256sum | cut -d' ' -f1 > "$KEYFILE"
chown root:www-data "$KEYFILE"
chmod 640 "$KEYFILE"
echo
echo 'SETUP COMPLETE. COPY THIS PRIVATE PAIRING KEY INTO YOUR GEODE MOD SETTINGS:'
echo "$TOKEN"
echo
echo 'Do not send this key in chat, screenshots, or Discord.'