#!/usr/bin/env bash

# 升级旧部署时补齐浏览器来源；显式配置始终保留并校验。
# 不 source .env，避免执行环境文件中的内容。

security_origin_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=scripts/init-public-api-base-url.sh
. "${security_origin_script_dir}/init-public-api-base-url.sh"

security_origin_valid() {
    local value rest
    value="$(public_url_normalize "$1")"
    public_url_validate "$value" || return 1
    rest="${value#*://}"
    [[ "$rest" != */* ]]
}

init_security_origin() {
    local file="${1:-.env}"
    local api_url origin current item scheme rest authority
    [ -f "$file" ] || {
        echo "❌ 环境配置文件不存在: $file" >&2
        return 1
    }

    api_url="$(public_url_read_env_value "$file" "CONFIG_PUBLIC_API_BASE_URL")"
    public_url_validate "$api_url" || {
        echo "❌ 请先配置有效的 CONFIG_PUBLIC_API_BASE_URL" >&2
        return 1
    }
    scheme="${api_url%%://*}"
    rest="${api_url#*://}"
    authority="${rest%%/*}"
    origin="${scheme}://${authority}"
    security_origin_valid "$origin" || return 1

    current="$(public_url_read_env_value "$file" "CONFIG_SECURITY_ORIGIN")"
    if [ -z "$current" ] || {
        [ "$current" = 'http://127.0.0.1,http://localhost' ] &&
        [ "$origin" != 'http://127.0.0.1' ];
    }; then
        public_url_write_env_value "$file" "CONFIG_SECURITY_ORIGIN" "$origin"
        echo "   ✓ 已配置浏览器来源: $origin"
        return 0
    fi

    local -a origins
    case "$current" in
        ,*|*,|*,,*)
            echo "❌ CONFIG_SECURITY_ORIGIN 包含空的来源地址" >&2
            return 1
            ;;
    esac
    IFS=',' read -r -a origins <<< "$current"
    [ "${#origins[@]}" -gt 0 ] || return 1
    for item in "${origins[@]}"; do
        item="$(printf '%s' "$item" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
        if ! security_origin_valid "$item"; then
            echo "❌ CONFIG_SECURITY_ORIGIN 包含无效或非浏览器来源，请填写 http(s) Origin，不能使用通配符或路径" >&2
            return 1
        fi
    done
}

if [ "${BASH_SOURCE[0]}" = "$0" ]; then
    init_security_origin "${1:-.env}"
fi