#!/bin/bash
set -euo pipefail

PHPMYADMIN_DIR="${PHPMYADMIN_PRIVATE_DIR:-${PHPMYADMIN_DIR:-/var/www/html/alt-mysql-phpmyadmin}}"
CONFIG_INC="${PHPMYADMIN_DIR}/config.inc.php"
SIGNON_SCRIPT="${PHPMYADMIN_DIR}/da_signon.php"
SIGNON_URL_PAGE="${PHPMYADMIN_DIR}/da_login.php"
RUNTIME_CONFIG="${PHPMYADMIN_DIR}/runtime/config.json"

fail() {
  printf 'phpMyAdmin alt-mysql health: %s\n' "$*" >&2
  exit 1
}

[ -d "$PHPMYADMIN_DIR" ] || fail "phpMyAdmin directory not found: $PHPMYADMIN_DIR"
[ -r "$PHPMYADMIN_DIR/index.php" ] || fail "phpMyAdmin index.php is not readable: $PHPMYADMIN_DIR/index.php"
[ -r "$CONFIG_INC" ] || fail "config.inc.php is not readable: $CONFIG_INC"
[ -r "$SIGNON_SCRIPT" ] || fail "signon script is not readable: $SIGNON_SCRIPT"
[ -r "$SIGNON_URL_PAGE" ] || fail "SignonURL page is not readable: $SIGNON_URL_PAGE"
grep -Fq "DA_MYSQL_PMA_DEFAULT_CONF" "$CONFIG_INC" || fail "config.inc.php does not configure alt-mysql endpoint"
grep -Fq "auth_type'] = 'signon" "$CONFIG_INC" || fail "config.inc.php does not configure signon auth"
grep -Fq "SignonURL'] = da_mysql_phpmyadmin_signon_url" "$CONFIG_INC" || fail "config.inc.php does not configure dynamic SignonURL"
grep -Fq "da_mysql_login_consume_ticket" "$SIGNON_URL_PAGE" || fail "da_login.php does not consume SSO tickets"
grep -Fq "DA_MYSQL_DEFAULT_CONF = '/usr/local/directadmin/conf/alt-mysql.conf'" "$SIGNON_SCRIPT" \
  || fail "signon script does not default to alt-mysql.conf"

if [ -r "$RUNTIME_CONFIG" ] && command -v php >/dev/null 2>&1; then
  php -r '
    $path = $argv[1];
    $data = json_decode(file_get_contents($path), true);
    if (!is_array($data)) {
        fwrite(STDERR, "runtime config is not valid JSON\n");
        exit(2);
    }
    if (($data["credentials_file"] ?? "") === "/usr/local/directadmin/conf/mysql.conf") {
        fwrite(STDERR, "runtime config points to native DirectAdmin mysql.conf\n");
        exit(3);
    }
  ' "$RUNTIME_CONFIG" || fail "runtime config validation failed"
fi

echo "phpMyAdmin alt-mysql health: OK"