#!/bin/sh
set -eu

data_dir=${MCPHUB_SETTING_PATH:-/app/data/}
case "$data_dir" in
  */) state_dir=${data_dir%/} ;;
  *) state_dir=$(dirname "$data_dir") ;;
esac
mkdir -p "$state_dir"

# A stable signing key prevents every container recreation from invalidating
# all logged-in browser sessions.  It lives only in persistent appdata.
jwt_file="$state_dir/jwt-secret"
if [ ! -s "$jwt_file" ]; then
  umask 077
  python3 -c 'import secrets; print(secrets.token_urlsafe(64))' > "$jwt_file"
fi
JWT_SECRET=$(cat "$jwt_file")
export JWT_SECRET

exec "$@"