#!/bin/bash
set -Eeuo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
PLUGIN_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
SETTINGS_FILE="$PLUGIN_DIR/plugin-settings.conf"
LOG_FILE="${DA_ALT_MYSQL_DB_HOOK_LOG:-$PLUGIN_DIR/data/logs/da-db-hooks.log}"
HOOK_NAME="${DA_HOOK_NAME:-$(basename "$0")}"

mkdir -p "$(dirname "$LOG_FILE")"

read_plugin_setting() {
  local key="$1"
  local default="$2"
  local line value
  [ -r "$SETTINGS_FILE" ] || {
    printf '%s\n' "$default"
    return 0
  }
  line="$(grep -E "^${key}=" "$SETTINGS_FILE" | tail -n 1 || true)"
  [ -n "$line" ] || {
    printf '%s\n' "$default"
    return 0
  }
  value="${line#*=}"
  value="${value%%#*}"
  value="${value%\"}"
  value="${value#\"}"
  value="${value%\'}"
  value="${value#\'}"
  value="$(printf '%s' "$value" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
  printf '%s\n' "${value:-$default}"
}

log() {
  printf '[%s] hook=%s username=%s database=%s user=%s %s\n' \
    "$(date '+%Y-%m-%d %H:%M:%S')" \
    "$HOOK_NAME" \
    "${username:-}" \
    "${database:-${name:-}}" \
    "${user:-}" \
    "$*" >> "$LOG_FILE"
}

enabled="$(read_plugin_setting DA_ALT_MYSQL_BLOCK_NATIVE_DB_HOOKS true)"
case "$enabled" in
  true|yes|on|1) ;;
  *) log "native DB hook blocker disabled"; exit 0 ;;
esac

if [ "${DA_ALT_MYSQL_ALLOW_NATIVE_DB_ACTION:-0}" = "1" ]; then
  log "native DB action explicitly allowed by environment"
  exit 0
fi

case "$HOOK_NAME" in
  *_post.sh|*_post)
    log "native DirectAdmin database action observed after completion"
    exit 0
    ;;
esac

log "blocked native DirectAdmin database action"
cat >&2 <<'EOF'
Databases on this server are managed by the MySQL plugin and the alt-mariadb instance.
Use the MySQL plugin instead of DirectAdmin native database actions.
EOF
exit 1