#!/usr/bin/env bash
set -euo pipefail

# Credential-free wrapper for functional-status-demo-correction.php.
# The production PHP runtime disables process execution, so this wrapper creates
# the required non-Web mysqldump before invoking PHP apply.

MODE="${1:-dry-run}"
PHP_BIN="${PHP_BIN:-/usr/local/php7.3/bin/php}"
PROJECT_DIR="/workspace/wwwroot/tnxlgstyj/project"
DB_CONFIG="$PROJECT_DIR/application/config/prod/tnxlgstyj/database.php"
PHP_SCRIPT="${PHP_SCRIPT:-/tmp/functional-status-demo-correction.php}"
BACKUP_DIR="/root/gstyj-maintenance/20260826-functional-status-correction"
BACKUP_SQL="$BACKUP_DIR/before-full-tables.sql"

case "$MODE" in
  dry-run|simulate|apply|verify|rollback) ;;
  *) echo "Usage: $0 dry-run|simulate|apply|verify|rollback" >&2; exit 2 ;;
esac

[[ -x "$PHP_BIN" ]] || { echo "PHP runtime is unavailable: $PHP_BIN" >&2; exit 3; }
[[ -r "$DB_CONFIG" ]] || { echo "Database config is unreadable: $DB_CONFIG" >&2; exit 3; }
[[ -r "$PHP_SCRIPT" ]] || { echo "PHP migration script is unreadable: $PHP_SCRIPT" >&2; exit 3; }

if [[ "$MODE" == "apply" && ! -s "$BACKUP_SQL" ]]; then
  eval "$("$PHP_BIN" -r '$c=include $argv[1]; foreach(["hostname"=>"FSC_DB_HOST","username"=>"FSC_DB_USER","password"=>"FSC_DB_PASS","database"=>"FSC_DB_NAME"] as $k=>$v){echo "export $v=".escapeshellarg($c[$k]).";";}' "$DB_CONFIG")"
  install -d -m 700 "$BACKUP_DIR"
  task_backup_tmp="$BACKUP_SQL.tmp.$$"
  trap 'rm -f "$task_backup_tmp"' EXIT
  MYSQL_PWD="$FSC_DB_PASS" mysqldump \
    --single-transaction \
    --skip-lock-tables \
    --default-character-set=utf8mb4 \
    -h"$FSC_DB_HOST" \
    -u"$FSC_DB_USER" \
    "$FSC_DB_NAME" \
    tn_test_result \
    tn_test_value \
    tn_test_result_value \
    tn_manage_staff \
    tn_test \
    tn_staff_test \
    tn_staff_physical_test > "$task_backup_tmp"
  [[ -s "$task_backup_tmp" ]] || { echo "Backup output is empty." >&2; exit 4; }
  mv "$task_backup_tmp" "$BACKUP_SQL"
  chmod 600 "$BACKUP_SQL"
  trap - EXIT
fi

cd "$PROJECT_DIR"
exec "$PHP_BIN" "$PHP_SCRIPT" "$MODE"