#!/bin/sh
# What this repository adds to BentoPDF's finished build, run in the
# Dockerfile's builder stage after `npm run build`:
#
#   finish.sh <app-dir>
#
#   1. a <script src="/bau-pm/handoff.js"> in every HTML page, the PDF.js
#      viewers' pages included (the sign tool saves from inside one of them);
#   2. the precompressed copies of those pages regenerated, because nginx's
#      gzip_static would otherwise serve the old page without the tag;
#   3. every host taken out of the generated Content-Security-Policy, so the
#      pages may load from their own origin and from nowhere else.
#
# Each step checks its own result and fails the build when it did not happen.
set -eu

app=$1
dist=$app/dist
tag='<script src="/bau-pm/handoff.js"></script>'

pages=$(find "$dist" -name '*.html' | wc -l)
[ "$pages" -gt 100 ] || { echo "finish: only $pages pages in $dist" >&2; exit 1; }

find "$dist" -name '*.html' | while read -r page; do
  grep -q '</head>' "$page" || { echo "finish: $page has no </head>" >&2; exit 1; }
  sed -i "s#</head>#$tag</head>#" "$page"
  rm -f "$page.gz" "$page.br"
  gzip -9 -k -n "$page"
done
# find -exec rather than grep --include, which busybox's grep does not know.
tagged=$(find "$dist" -name '*.html' -exec grep -lF "$tag" {} + | wc -l)
[ "$tagged" -eq "$pages" ] || { echo "finish: $tagged of $pages pages carry the tag" >&2; exit 1; }
stale=$(find "$dist" -name '*.html.br' | wc -l)
[ "$stale" -eq 0 ] || { echo "finish: $stale brotli copies left" >&2; exit 1; }

for conf in security-headers.conf security-headers-docs.conf; do
  sed -E -i 's# https?:(//[^ ;"]*)?##g' "$app/$conf"
  if grep -Eq 'https?:' "$app/$conf"; then
    echo "finish: $conf still names a host:" >&2
    grep -Eo 'https?:[^ ;"]*' "$app/$conf" >&2
    exit 1
  fi
done

echo "finish: $tagged pages tagged, CSP without hosts"