#!/bin/sh
set -eu

# 1. 环境检查
if [ -z "${APP_ARCHIVE_URL:-}" ]; then
  echo "Error: APP_ARCHIVE_URL is not set." >&2
  exit 1
fi

# 2. 准备目录
mkdir -p /opt/app
cd /opt/app
ARCHIVE_FILE="app_archive"

# 3. 清洗 Cloudflare 变量 (核心修正：去除换行、空格、单双引号)
CF_ID="$(printf '%s' "${CF_ACCESS_CLIENT_ID:-}" | tr -d '\r\n "\047')"
CF_SECRET="$(printf '%s' "${CF_ACCESS_CLIENT_SECRET:-}" | tr -d '\r\n "\047')"

# 4. 组装 Curl (含浏览器伪装，防止 WAF 拦截)
# -f: 失败报错 -s: 静默 -S: 出错时显示 -L: 跟随重定向
UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
set -- -fsSL -A "$UA" "$APP_ARCHIVE_URL" -o "$ARCHIVE_FILE"

if [ -n "$CF_ID" ] && [ -n "$CF_SECRET" ]; then
  set -- -H "CF-Access-Client-Id: $CF_ID" \
         -H "CF-Access-Client-Secret: $CF_SECRET" \
         "$@"
fi

# 5. 下载
echo "[entrypoint] Downloading..." >&2
if ! curl "$@"; then
  echo "Error: Download failed." >&2
  exit 1
fi

# 6. 解压
echo "[entrypoint] Extracting..." >&2
unzip -oq "$ARCHIVE_FILE" 2>/dev/null || tar -xzf "$ARCHIVE_FILE" 2>/dev/null
rm -f "$ARCHIVE_FILE"

# 7. 启动
echo "[entrypoint] Starting app..." >&2
sh start.sh