#!/usr/bin/env bash
set -euo pipefail
APP_DIR="/opt/podpissk-pades-bridge"
PKCS11_LIBRARY="${EPODPIS_PKCS11:-/usr/lib/eID_klient/libpkcs11_x64.so}"
JAVA_BIN="${EPODPIS_JAVA:-/usr/lib/jvm/java-21-openjdk-amd64/bin/java}"
STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/podpissk-pades-bridge"
mkdir -p "$STATE_DIR"
export QT_QPA_PLATFORM="${QT_QPA_PLATFORM:-xcb}"
test -f "$PKCS11_LIBRARY" || { echo "PKCS#11 knižnica sa nenašla: $PKCS11_LIBRARY" >&2; exit 1; }
test -x "$JAVA_BIN" || { echo "Java 21 sa nenašla: $JAVA_BIN" >&2; exit 1; }
LOG_FILE="$STATE_DIR/bridge.log"
exec 9>"$STATE_DIR/bridge.lock"
flock -n 9 || exit 0

JAVA_PID=""
TRAY_PID=""
cleanup_children() {
    [[ -z "$TRAY_PID" ]] || kill "$TRAY_PID" 2>/dev/null || true
    [[ -z "$JAVA_PID" ]] || kill "$JAVA_PID" 2>/dev/null || true
}
trap cleanup_children EXIT INT TERM

if [[ -f "$LOG_FILE" ]] && [[ $(stat -c %s "$LOG_FILE" 2>/dev/null || echo 0) -gt 5242880 ]]; then
    rm -f "$LOG_FILE.3"
    [[ ! -f "$LOG_FILE.2" ]] || mv "$LOG_FILE.2" "$LOG_FILE.3"
    [[ ! -f "$LOG_FILE.1" ]] || mv "$LOG_FILE.1" "$LOG_FILE.2"
    mv "$LOG_FILE" "$LOG_FILE.1"
fi

while true; do
    set +e
    "$JAVA_BIN" \
        --add-modules jdk.httpserver,jdk.crypto.cryptoki \
        --add-exports jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED \
        --add-opens java.base/java.security=ALL-UNNAMED \
        --add-opens jdk.crypto.cryptoki/sun.security.pkcs11=ALL-UNNAMED \
        -Depodpis.pkcs11="$PKCS11_LIBRARY" \
        -Depodpis.tray=false \
        -Depodpis.bridge.version="0.5.1" \
        -Depodpis.log.path="$LOG_FILE" \
        -cp "$APP_DIR/bridge.jar:$APP_DIR/lib/*" \
        EidPadesBridge >>"$LOG_FILE" 2>&1 &
    JAVA_PID=$!
    for _ in {1..30}; do curl --fail --silent http://127.0.0.1:8765/health >/dev/null && break; sleep 0.2; done
    python3 "$APP_DIR/tray.py" >>"$LOG_FILE" 2>&1 &
    TRAY_PID=$!
    wait "$JAVA_PID"
    EXIT_CODE=$?
    JAVA_PID=""
    kill "$TRAY_PID" 2>/dev/null || true
    wait "$TRAY_PID" 2>/dev/null || true
    TRAY_PID=""
    set -e
    [[ $EXIT_CODE -eq 0 ]] && exit 0
    if [[ $EXIT_CODE -eq 42 ]]; then
        printf '%s Aktualizácia bola nainštalovaná; načítavam nový spúšťací skript.\n' "$(date --iso-8601=seconds)" >>"$LOG_FILE"
        exec 9>&-
        exec /usr/bin/podpissk-pades-bridge
    fi
    printf '%s Most skončil s kódom %s; reštartujem ho o 3 sekundy.\n' "$(date --iso-8601=seconds)" "$EXIT_CODE" >>"$LOG_FILE"
    sleep 3
done
