#!/bin/sh
set -eu

# SECUREBRIDGE-06: trust the socket peer only, never a forwarded client header.
case "${AI_ARTIFACT_ACCESS_POLICY:-lan_public}" in
    lan_public)
        cidr=${AI_ARTIFACT_LAN_CIDR:-192.168.50.0/24}
        # Strict IPv4 RFC1918 subnet, never forwarded headers or an all-network allow.
        if ! printf '%s\n' "$cidr" | awk '
            BEGIN { FS="[./]"; valid=0 }
            NF==5 && $0 ~ /^[0-9.]+\/[0-9]+$/ {
                valid=1
                for(i=1;i<=4;i++) if($i<0 || $i>255 || $i !~ /^(0|[1-9][0-9]*)$/) valid=0
                if($5<1 || $5>32 || $5 !~ /^[1-9][0-9]*$/) valid=0
                if(!($1==10 && $5>=8) && !($1==172 && $2>=16 && $2<=31 && $5>=12) && !($1==192 && $2==168 && $5>=16)) valid=0
                for(i=1;i<=4;i++) {
                    bits=$5-8*(i-1); if(bits<0) bits=0; if(bits>8) bits=8
                    if($i % (2^(8-bits)) != 0) valid=0
                }
            }
            END { exit !(NR==1 && valid) }'; then
            echo 'Invalid AI_ARTIFACT_LAN_CIDR' >&2
            exit 1
        fi
        printf '%s\n' "allow $cidr;" 'deny all;' 'auth_request off;' > /tmp/media-access.conf
        ;;
    authenticated)
        printf '%s\n' 'auth_request /_bridge_media_auth;' > /tmp/media-access.conf
        ;;
    *)
        echo 'Invalid AI_ARTIFACT_ACCESS_POLICY' >&2
        exit 1
        ;;
esac
envsubst '${AI_CONTROL_HOST_PORT}' < /etc/bridge/nginx.conf.template > /tmp/nginx.conf
nginx -t -c /tmp/nginx.conf
if [ "${1:-}" = '--check' ]; then exit 0; fi
exec nginx -c /tmp/nginx.conf -g 'daemon off;'