#!/bin/sh
# One-shot MinIO bootstrap (service `minio-init`, image minio/mc): bucket + least-privilege app user.
# Idempotent: safe to re-run on every `compose up`.
set -eu
: "${MINIO_ROOT_USER:?}" "${MINIO_ROOT_PASSWORD:?}" "${S3_ACCESS_KEY:?}" "${S3_SECRET_KEY:?}"
BUCKET="${S3_BUCKET:-dci-raw}"

i=0
until mc alias set local http://minio:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null 2>&1; do
  i=$((i + 1)); [ "$i" -ge 60 ] && { echo "minio-init: minio not reachable" >&2; exit 1; }
  sleep 2
done

mc mb --ignore-existing "local/$BUCKET"
mc anonymous set none "local/$BUCKET" >/dev/null

# app user restricted to the bucket (policy JSON is bucket-name specific: dci-raw)
mc admin user add local "$S3_ACCESS_KEY" "$S3_SECRET_KEY" >/dev/null 2>&1 || true
mc admin policy create local dci-raw-rw /policy/policy-dci-raw.json >/dev/null 2>&1 || true
mc admin policy attach local dci-raw-rw --user "$S3_ACCESS_KEY" >/dev/null 2>&1 || true

echo "minio-init: bucket $BUCKET ready, user $S3_ACCESS_KEY has policy dci-raw-rw"
mc ls local/