#!/bin/sh
set -eu

endpoint=http://rustfs:9000

if ! aws --endpoint-url "$endpoint" s3api head-bucket --bucket "$S3_BUCKET" >/dev/null 2>&1; then
    if [ "$AWS_DEFAULT_REGION" = us-east-1 ]; then
        aws --endpoint-url "$endpoint" s3api create-bucket --bucket "$S3_BUCKET"
    else
        aws --endpoint-url "$endpoint" s3api create-bucket --bucket "$S3_BUCKET" \
            --create-bucket-configuration "LocationConstraint=$AWS_DEFAULT_REGION"
    fi
fi

# Dashboard images need public object reads. Listing and writes remain authenticated.
cat > /tmp/public-images-policy.json <<EOF
{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::$S3_BUCKET/uploads/*"
    }]
}
EOF
aws --endpoint-url "$endpoint" s3api put-bucket-policy --bucket "$S3_BUCKET" \
    --policy file:///tmp/public-images-policy.json
echo "RustFS development bucket ready: $S3_BUCKET"