#!/usr/bin/env bash
# ==============================================================================
# start.sh – Bootstrap script for n8n on Hugging Face Spaces
#
# Runs as root (PID 1 is tini), fixes the permission wall, then drops
# privileges to uid 1000 before executing n8n.
# ==============================================================================
set -euo pipefail

N8N_DATA="/data/.n8n"

echo "▸ [start.sh] Ensuring data directory exists …"
mkdir -p "${N8N_DATA}"

# ---------- Fix the Permission Wall -------------------------------------------
# HF mounts /data owned by a different uid. n8n refuses to start if config
# files are readable by group/other (requires 0600 / 0700).
echo "▸ [start.sh] Fixing ownership → 1000:1000 …"
chown -R 1000:1000 /data

echo "▸ [start.sh] Fixing permissions → dirs 0700, files 0600 …"
find "${N8N_DATA}" -type d -exec chmod 0700 {} +
find "${N8N_DATA}" -type f -exec chmod 0600 {} +

# ---------- Drop Privileges & Launch ------------------------------------------
echo "▸ [start.sh] Dropping to user node (1000), starting n8n on port ${N8N_PORT:-7860} …"

# su-exec replaces the current process (no intermediate shell).
# Call n8n via its full path to bypass the broken global symlink.
exec su-exec node node /usr/local/lib/node_modules/n8n/bin/n8n start