<?php
/**
 * One-shot: create QNAP OSS bucket and verify read/write.
 * Run on server: docker exec geonet-console php /tmp/oss-create-bucket.php
 *
 * Env: OSS_ACCESS_KEY_ID, OSS_SECRET_ACCESS_KEY, OSS_ENDPOINT, OSS_REGION, OSS_BUCKET_TARGET
 */
declare(strict_types=1);

require '/var/www/html/vendor/autoload.php';

$bucket = getenv('OSS_BUCKET_TARGET') ?: 'zammad-attachments';
$endpoint = getenv('OSS_ENDPOINT') ?: 'http://10.100.1.10:8010';
$key = getenv('OSS_ACCESS_KEY_ID') ?: '';
$secret = getenv('OSS_SECRET_ACCESS_KEY') ?: '';
$region = getenv('OSS_REGION') ?: 'us-east-1';

if ($key === '' || $secret === '') {
    fwrite(STDERR, "Missing OSS_ACCESS_KEY_ID or OSS_SECRET_ACCESS_KEY\n");
    exit(1);
}

$client = new Aws\S3\S3Client([
    'version' => 'latest',
    'region' => $region,
    'endpoint' => $endpoint,
    'use_path_style_endpoint' => true,
    'credentials' => [
        'key' => $key,
        'secret' => $secret,
    ],
]);

echo "=== List buckets ===\n";
foreach ($client->listBuckets()['Buckets'] ?? [] as $b) {
    echo ' - ' . $b['Name'] . "\n";
}

if (!$client->doesBucketExist($bucket)) {
    echo "Creating bucket: {$bucket}\n";
    $client->createBucket(['Bucket' => $bucket]);
    echo "Created.\n";
} else {
    echo "Bucket already exists: {$bucket}\n";
}

$testKey = '_healthcheck/oss-setup-test.txt';
$body = 'zammad-oss-test-' . gmdate('c');

$lastError = null;
for ($attempt = 1; $attempt <= 5; $attempt++) {
    try {
        $client->putObject([
            'Bucket' => $bucket,
            'Key' => $testKey,
            'Body' => $body,
            'ContentType' => 'text/plain',
        ]);
        echo "Upload OK (attempt {$attempt}): {$testKey}\n";
        $lastError = null;
        break;
    } catch (Throwable $e) {
        $lastError = $e;
        echo "Upload attempt {$attempt} failed: " . $e->getMessage() . "\n";
        sleep(3);
    }
}

if ($lastError !== null) {
    fwrite(STDERR, "Upload failed after retries. Bucket exists but write test did not pass.\n");
    exit(2);
}

$got = (string) $client->getObject(['Bucket' => $bucket, 'Key' => $testKey])['Body'];
if ($got !== $body) {
    fwrite(STDERR, "Download mismatch\n");
    exit(1);
}
echo "Download OK\n";
echo "DONE: bucket {$bucket} ready (private — no public ACL set)\n";