#!/bin/sh
# Started by ttyd for every browser terminal, with the terminal handle from
# the URL (?arg=) as $1. Trades the handle for the bokfd session at the
# gate (bokfweb /redeem, internal only), then runs bokftui already logged
# in, in a private throwaway HOME, in web mode (no local files), with
# resource limits. No shell is ever offered: when bokftui exits, the
# terminal ends.
set -u
gate="${BOKFWEB_INTERNAL:-http://127.0.0.1:7682}"

msg() {
    printf '\r\n  %s\r\n\r\n' "$1"
    sleep 4
    exit 1
}

handle="${1:-}"
case "$handle" in
    "" | *[!A-Za-z0-9_-]*) msg "Ogiltig länk. Öppna /web/ och logga in igen." ;;
esac

session=$(wget -q -O - --post-data "handle=$handle" "$gate/redeem" 2>/dev/null) ||
    msg "Sessionen har gått ut. Öppna /web/ och logga in igen."
case "$session" in
    "" | *[!A-Za-z0-9_-]*) msg "Sessionen har gått ut. Öppna /web/ och logga in igen." ;;
esac

home=$(mktemp -d /tmp/bokf-web.XXXXXXXX) || msg "Kunde inte starta sessionen."
trap 'rm -rf "$home"' EXIT HUP INT TERM
chmod 0700 "$home"

# per-session limits: memory, CPU time, open files (the process count is
# capped per container in compose.yaml: every session runs as one uid)
ulimit -v 524288 2>/dev/null || true
ulimit -t 7200 2>/dev/null || true
ulimit -n 256 2>/dev/null || true

HOME="$home" XDG_CONFIG_HOME="$home/.config" XDG_CACHE_HOME="$home/.cache" \
BOKF_WEB=1 BOKFD_SESSION="$session" \
    bokftui --socket "${BOKFD_SOCKET:-/run/bokfd/bokfd.sock}"