#!/bin/bash
set -e

# SSO plugin installer — runs before the original CryptPad entrypoint.
# Clones the cryptpad/sso plugin into the plugins volume if not already present
# or if the version has changed.

# Skips SSO setup entirely when SSO_ENABLED is not "true".
if [ "${SSO_ENABLED}" != "true" ]; then
  echo "[sso-entrypoint] SSO not enabled, skipping plugin install"
  exec "$@"
fi

PLUGIN_DIR="/cryptpad/lib/plugins/sso"
VERSION_FILE="${PLUGIN_DIR}/.version"
SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-1.0.0}"

# sso.js is mounted directly at /cryptpad/config/sso.js as a Docker config:
# since CryptPad 2026.10.0, /cryptpad/config is root-owned and not writable.

# Install/update the SSO plugin
if [ -f "${VERSION_FILE}" ] && [ "$(cat "${VERSION_FILE}")" = "${SSO_PLUGIN_VERSION}" ]; then
  echo "[sso-entrypoint] SSO plugin ${SSO_PLUGIN_VERSION} already installed"
else
  echo "[sso-entrypoint] Installing SSO plugin ${SSO_PLUGIN_VERSION} ..."
  rm -rf "${PLUGIN_DIR}"
  git clone --depth 1 --branch "${SSO_PLUGIN_VERSION}" \
    https://github.com/cryptpad/sso.git "${PLUGIN_DIR}"
  # Since CryptPad 2026.10.0 the plugin's dependencies (openid-client,
  # node-saml, ...) are no longer bundled with CryptPad itself.
  if [ -f "${PLUGIN_DIR}/package.json" ]; then
    (cd "${PLUGIN_DIR}" && npm ci --omit=dev)
  fi
  echo "${SSO_PLUGIN_VERSION}" > "${VERSION_FILE}"
  echo "[sso-entrypoint] SSO plugin installed"
fi

# Hand off to the original CryptPad entrypoint
exec "$@"