#!/bin/bash

fixPermissionsBeforeStart()
{
    local app_name="$1"
    local flag="$2"
    
    if [[ $flag == "update" ]]; then
        isHeader "Updating File/Folder Permissions"
    fi

    fixAppFolderPermissions;
    changeRootOwnedFile $docker_dir/$db_file $sudo_user_name

    # The regenerable WebUI dir is reconciled to the mode's container owner via
    # the shared helper (same code path as install + switch). Third-party app
    # data ownership is established at install/restore time, not blanket-chowned
    # here — a wrong-owner chown would break permission-strict apps.
    if [[ "$app_name" == "libreportal" ]]; then
        reconcileWebuiDirOwnership
    fi

    # Traefik
    if [ -f "${containers_dir}traefik/etc/certs/acme.json" ]; then
        updateFileOwnership "${containers_dir}traefik/etc/certs/acme.json" $docker_install_user $docker_install_user
        local result=$(runFileOp chmod 600 "${containers_dir}traefik/etc/certs/acme.json")
        checkSuccess "Set permissions to acme.json file for traefik"
    fi
    if [ -f "${containers_dir}traefik/etc/traefik.yml" ]; then
        updateFileOwnership "${containers_dir}traefik/etc/traefik.yml" $docker_install_user $docker_install_user
        local result=$(runFileOp chmod 600 "${containers_dir}traefik/etc/traefik.yml")
        checkSuccess "Set permissions to traefik.yml file for traefik"
    fi
}