#!/bin/bash

fixPermissionsBeforeStart()
{
    local app_name="$1"
    local flag="$2"
    
    if [[ $flag == "update" ]]; then
        isHeader "Updating File/Folder Permissions"
    fi

    fixAppFolderPermissions;
    runOwnership db-own

    # The regenerable WebUI dir is reconciled to the mode's container owner via
    # the shared helper (same code path as install + switch). Third-party app
    # data ownership is established at install/restore time, not blanket-chowned
    # here — a wrong-owner chown would break permission-strict apps.
    if [[ "$app_name" == "libreportal" ]]; then
        reconcileWebuiDirOwnership
    fi

    # Traefik
    if [ -f "${containers_dir}traefik/etc/certs/acme.json" ]; then
        runOwnership app-file traefik etc/certs/acme.json
        local result=$(runFileOp chmod 600 "${containers_dir}traefik/etc/certs/acme.json")
        checkSuccess "Set permissions to acme.json file for traefik"
    fi
    if [ -f "${containers_dir}traefik/etc/traefik.yml" ]; then
        runOwnership app-file traefik etc/traefik.yml
        local result=$(runFileOp chmod 600 "${containers_dir}traefik/etc/traefik.yml")
        checkSuccess "Set permissions to traefik.yml file for traefik"
    fi
}