#!/bin/bash
set -e

echo "Setting file permissions..."
chown -Rf www-data:git /var/www/
chmod -Rf 777 /var/www/Inovalon_files
chmod -Rf 777 /var/www/datafiles
chmod -Rf 777 /var/www/XMLfiles
chmod -Rf 777 /var/www/xmlfilecreation
chmod -Rf 777 /var/www/Upload
chmod -Rf 777 /var/www/Medicationfiles
chmod -Rf 777 /var/www/claimfiles
chmod -Rf 777 /var/www/faxfiles
chmod -Rf 777 /var/www/managementreports/CSV

# Keep sensitive folders blocked from public HTTP (app still uses filesystem paths)
HTACCESS_DENY='# Block public HTTP access. App uses local filesystem paths only.
Require all denied
'
for d in \
  /var/www/Inovalon_files \
  /var/www/datafiles \
  /var/www/XMLfiles \
  /var/www/xmlfilecreation \
  /var/www/Upload \
  /var/www/Medicationfiles \
  /var/www/claimfiles \
  /var/www/faxfiles \
  /var/www/managementreports/CSV
do
  if [ -d "$d" ]; then
    printf '%s\n' "$HTACCESS_DENY" > "$d/.htaccess"
    chmod 644 "$d/.htaccess"
  fi
done

# UI still needs these image folders over HTTP
for sub in Patient_images Employee_images Agency_Logos; do
  if [ -d "/var/www/datafiles/$sub" ]; then
    printf '%s\n' 'Require all granted
Options -Indexes
' > "/var/www/datafiles/$sub/.htaccess"
    chmod 644 "/var/www/datafiles/$sub/.htaccess"
  fi
done

# datafiles root: deny by default, allow payment card icons used by UI
if [ -d /var/www/datafiles ]; then
  cat > /var/www/datafiles/.htaccess << 'EOF'
# Block public HTTP by default. App uses /var/www/datafiles filesystem paths.
Require all denied

# Payment card icons used by agency UI at datafiles root
<FilesMatch "^(visa|mastercard|amex)\.(jpg|jpeg|png|gif)$">
    Require all granted
</FilesMatch>
EOF
  chmod 644 /var/www/datafiles/.htaccess
fi

echo "Permission setting completed"