#!/bin/sh
set -e

# Volume-mounted dirs (jwt_keys, uploads) are created/owned by root on first run.
# Ensure the runtime user can write to them. Runs every start; cheap and idempotent.
chown -R www-data:www-data var public/uploads config/jwt 2>/dev/null || true

# One-time init tasks — only the web service runs these (RUN_INIT=1).
# Workers set RUN_INIT=0 so DB migrations / JWT generation don't race.
if [ "${RUN_INIT:-1}" = "1" ]; then
    # Generate JWT keypair if not already persisted on the jwt_keys volume.
    php bin/console lexik:jwt:generate-keypair --skip-if-exists --no-interaction

    # Rebuild the prod cache (vendor was installed with --no-scripts at build time).
    php bin/console cache:clear --no-warmup
    php bin/console cache:warmup

    # Apply pending migrations. --all-or-nothing wraps them in a transaction.
    php bin/console doctrine:migrations:migrate --all-or-nothing --no-interaction
fi

exec "$@"