#!/bin/bash
# alpha-phpini — apply allow-listed php.ini overrides to every installed PHP-FPM
# (drop-in /etc/php/<ver>/fpm/conf.d/99-alpha.ini) and reload. Root-owned; called
# by www-data via NOPASSWD sudoers. Only whitelisted directives + validated values.
#   set key=value [key=value ...]
set -euo pipefail
ACTION="${1:-}"; shift || true

key_ok() {
  case "$1" in
    memory_limit|upload_max_filesize|post_max_size|max_execution_time|max_input_time|\
    max_input_vars|max_file_uploads|display_errors|default_socket_timeout|\
    session.gc_maxlifetime|opcache.memory_consumption|opcache.max_accelerated_files) return 0 ;;
    *) return 1 ;;
  esac
}
# sizes (128M / 1G), ints, -1, On/Off/0/1
val_ok() { [[ "$1" =~ ^-?[0-9]+[KMGkmg]?$ || "$1" =~ ^(On|Off|on|off|0|1)$ ]]; }

case "$ACTION" in
  set)
    [ "$#" -gt 0 ] || { echo "NO_KEYS"; exit 4; }
    declare -a lines=() reloads=()
    for pair in "$@"; do
      k="${pair%%=*}"; v="${pair#*=}"
      key_ok "$k" || { echo "BAD_KEY: $k"; exit 2; }
      val_ok "$v" || { echo "BAD_VALUE: $k=$v"; exit 3; }
      lines+=("$k = $v")
    done
    for d in /etc/php/*/fpm/conf.d; do
      [ -d "$d" ] || continue
      { echo "; Managed by the Alpha panel — edit php.ini settings in Server Administration"; printf '%s\n' "${lines[@]}"; } > "$d/99-alpha.ini"
      ver=$(echo "$d" | sed -nE 's#.*/php/([0-9.]+)/.*#\1#p')
      [ -n "$ver" ] && reloads+=("php${ver}-fpm")
    done
    # reload detached + delayed so we never drop the caller's own php-fpm response (502)
    setsid bash -c "sleep 1; for s in ${reloads[*]:-}; do systemctl reload \$s 2>/dev/null || systemctl restart \$s 2>/dev/null; done" >/dev/null 2>&1 </dev/null &
    echo "OK: applied to ${#reloads[@]} PHP-FPM version(s)"
    ;;
  get)
    cat /etc/php/*/fpm/conf.d/99-alpha.ini 2>/dev/null | grep -vE '^;|^$' | sort -u || true
    ;;
  *) echo "BAD_ACTION"; exit 1 ;;
esac
