#!/usr/bin/env bash
# migrate_superx_webapp.sh
# Version 1.5
#
# Migriert eine bestehende SuperX-Installation in eine neue Webapp-Struktur.
# Standardziel: /home/superx/webapps/superx
# Optional: Symlink aus Tomcat-webapps auf TARGET_WEBAPP.

set -euo pipefail

SCRIPT_NAME="$(basename "$0")"
SCRIPT_VERSION="1.6"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CONFIG_FILE="$SCRIPT_DIR/migrate_superx.conf"

log() { echo "[$SCRIPT_NAME] $*"; }
warn() { echo "[$SCRIPT_NAME] WARNUNG: $*" >&2; }
fail() { echo "[$SCRIPT_NAME] FEHLER: $*" >&2; exit 1; }

is_true() { case "${1:-false}" in true|TRUE|yes|YES|ja|JA|1) return 0;; *) return 1;; esac; }
is_false() { case "${1:-false}" in false|FALSE|no|NO|nein|NEIN|0|"") return 0;; *) return 1;; esac; }
is_auto() { case "${1:-}" in auto|AUTO|Auto) return 0;; *) return 1;; esac; }
is_root() { [ "$(id -u)" -eq 0 ]; }
current_user() { id -un; }
user_exists() { id "$1" >/dev/null 2>&1; }
group_exists() { getent group "$1" >/dev/null 2>&1; }
user_in_group() { id -nG "$1" 2>/dev/null | tr ' ' '\n' | grep -qx "$2"; }
current_user_matches_target() { [ "$(current_user)" = "$WEBAPP_USER" ] && user_in_group "$(current_user)" "$WEBAPP_GROUP"; }
canon_path() { if command -v realpath >/dev/null 2>&1; then realpath -m "$1"; else printf '%s\n' "$1"; fi; }

run() {
    if is_true "${DRY_RUN:-false}"; then
        echo "[DRY-RUN] $*"
    else
        if is_true "${VERBOSE:-false}"; then echo "+ $*"; fi
        eval "$@"
    fi
}

usage() {
    cat <<USAGE
Nutzung:
  ./$SCRIPT_NAME

Die Datei migrate_superx.conf muss im selben Verzeichnis liegen wie dieses Skript.
Erwartet: $CONFIG_FILE

MIGRATION_MODE: full | db_only
DB_TRANSFER_MODE: copy | move
USAGE
}

load_config() {
    [ -f "$CONFIG_FILE" ] || { usage; fail "Config-Datei nicht gefunden: $CONFIG_FILE"; }
    # shellcheck disable=SC1090
    . "$CONFIG_FILE"

    : "${SQL_ENV:?SQL_ENV ist nicht gesetzt}"
    : "${TARGET_WEBAPP:?TARGET_WEBAPP ist nicht gesetzt}"
    : "${WEBAPP_USER:?WEBAPP_USER ist nicht gesetzt}"
    : "${WEBAPP_GROUP:?WEBAPP_GROUP ist nicht gesetzt}"

    MIGRATION_MODE="${MIGRATION_MODE:-full}"
    DB_TRANSFER_MODE="${DB_TRANSFER_MODE:-copy}"
    STOP_TOMCAT="${STOP_TOMCAT:-false}"
    START_TOMCAT="${START_TOMCAT:-false}"
    TOMCAT_SERVICE="${TOMCAT_SERVICE:-tomcat10}"
    CREATE_TOMCAT_SYMLINK="${CREATE_TOMCAT_SYMLINK:-false}"
    TOMCAT_WEBAPPS_DIR="${TOMCAT_WEBAPPS_DIR:-/var/lib/tomcat10/webapps}"
    TOMCAT_CONTEXT_NAME="${TOMCAT_CONTEXT_NAME:-superx}"
    REPLACE_EXISTING_SYMLINK="${REPLACE_EXISTING_SYMLINK:-false}"
    DELETE_TARGET="${DELETE_TARGET:-false}"
    ALLOW_EXISTING_TARGET="${ALLOW_EXISTING_TARGET:-true}"
    ALLOW_EXISTING_TARGET_DB="${ALLOW_EXISTING_TARGET_DB:-true}"
    DRY_RUN="${DRY_RUN:-false}"
    ADD_WEBAPP_USER_TO_GROUP="${ADD_WEBAPP_USER_TO_GROUP:-true}"
    CREATE_GROUP_IF_MISSING="${CREATE_GROUP_IF_MISSING:-false}"
    UPDATE_SQL_ENV="${UPDATE_SQL_ENV:-true}"
    SET_RIGHTS="${SET_RIGHTS:-true}"
    SET_OWNER="${SET_OWNER:-auto}"
    SET_CHMOD="${SET_CHMOD:-true}"
    FORCE_ALREADY_MIGRATED="${FORCE_ALREADY_MIGRATED:-false}"
    VERBOSE="${VERBOSE:-true}"

    case "$MIGRATION_MODE" in full|db_only) ;; *) fail "Ungueltiger MIGRATION_MODE: $MIGRATION_MODE";; esac
    case "$DB_TRANSFER_MODE" in copy|move) ;; *) fail "Ungueltiger DB_TRANSFER_MODE: $DB_TRANSFER_MODE";; esac
    case "$SET_OWNER" in auto|AUTO|Auto|true|TRUE|yes|YES|ja|JA|1|false|FALSE|no|NO|nein|NEIN|0) ;; *) fail "Ungueltiger SET_OWNER: $SET_OWNER";; esac
}

validate_basic_paths() {
    [ -f "$SQL_ENV" ] || fail "SQL_ENV nicht gefunden: $SQL_ENV"
    if [ "$MIGRATION_MODE" = "full" ]; then
        [ "$TARGET_WEBAPP" != "auto" ] || fail "TARGET_WEBAPP=auto ist bei MIGRATION_MODE=full nicht erlaubt."
    fi
    if [ "$TARGET_WEBAPP" != "auto" ]; then
        case "$TARGET_WEBAPP" in
            ""|"/"|"/var"|"/var/lib"|"/var/lib/tomcat"|"/var/lib/tomcat/webapps"|"/var/lib/tomcat10"|"/var/lib/tomcat10/webapps"|"/srv"|"/srv/tomcat"|"/srv/tomcat/webapps"|"/home"|"/tmp")
                fail "TARGET_WEBAPP ist zu allgemein/gefaehrlich: $TARGET_WEBAPP";;
        esac
    fi
    if is_true "$CREATE_TOMCAT_SYMLINK"; then
        [ -n "$TOMCAT_WEBAPPS_DIR" ] || fail "TOMCAT_WEBAPPS_DIR ist leer."
        [ -n "$TOMCAT_CONTEXT_NAME" ] || fail "TOMCAT_CONTEXT_NAME ist leer."
        case "$TOMCAT_CONTEXT_NAME" in */*|.*|"") fail "TOMCAT_CONTEXT_NAME ist ungueltig: $TOMCAT_CONTEXT_NAME";; esac
    fi
}

check_source_not_already_migrated() {
    SOURCE_SUPERX_DIR_REAL="$(canon_path "$SOURCE_SUPERX_DIR")"
    SOURCE_WEBAPP_REAL="$(canon_path "$SOURCE_WEBAPP")"
    case "$SOURCE_SUPERX_DIR_REAL" in
        "$SOURCE_WEBAPP_REAL"/*)
            if is_true "$FORCE_ALREADY_MIGRATED"; then
                warn "SUPERX_DIR liegt bereits innerhalb von WEBAPP. FORCE_ALREADY_MIGRATED=true, Migration wird trotzdem fortgesetzt."
            else
                fail "SUPERX_DIR liegt bereits innerhalb von WEBAPP. Die Installation sieht bereits migriert aus.

SUPERX_DIR=$SOURCE_SUPERX_DIR
WEBAPP=$SOURCE_WEBAPP

Nur im Notfall uebersteuern mit:
  FORCE_ALREADY_MIGRATED=\"true\""
            fi;;
    esac
}

load_old_sql_env() {
    # shellcheck disable=SC1090
    . "$SQL_ENV"
    [ -n "${SUPERX_DIR:-}" ] || fail "SUPERX_DIR wurde durch SQL_ENV nicht gesetzt."
    [ -n "${WEBAPP:-}" ] || fail "WEBAPP wurde durch SQL_ENV nicht gesetzt."

    SOURCE_SUPERX_DIR="$SUPERX_DIR"
    SOURCE_WEBAPP="$WEBAPP"
    check_source_not_already_migrated

    if [ -d "$SOURCE_SUPERX_DIR/db/bin" ]; then
        SOURCE_DB="$SOURCE_SUPERX_DIR/db"
        SOURCE_TYPE="ALT_ODER_FULL_RELEASE"
    elif [ -d "$SOURCE_SUPERX_DIR/bin" ] && [ "$(basename "$SOURCE_SUPERX_DIR")" = "db" ]; then
        SOURCE_DB="$SOURCE_SUPERX_DIR"
        SOURCE_TYPE="DB_DIREKT"
    elif [ -d "$SOURCE_SUPERX_DIR/db" ]; then
        SOURCE_DB="$SOURCE_SUPERX_DIR/db"
        SOURCE_TYPE="ALT_ODER_FULL_RELEASE"
    else
        fail "DB-Verzeichnis konnte nicht erkannt werden. SUPERX_DIR=$SOURCE_SUPERX_DIR"
    fi

    [ -d "$SOURCE_WEBAPP/WEB-INF" ] || fail "WEBAPP scheint keine SuperX-Webapp zu sein: $SOURCE_WEBAPP/WEB-INF fehlt."
    [ -d "$SOURCE_DB/bin" ] || fail "DB-bin-Verzeichnis fehlt: $SOURCE_DB/bin"

    if [ "$MIGRATION_MODE" = "db_only" ] && [ "$TARGET_WEBAPP" = "auto" ]; then
        TARGET_WEBAPP="$SOURCE_WEBAPP"
    fi

    TARGET_SUPERX_DIR="$TARGET_WEBAPP/WEB-INF/conf/edustore"
    TARGET_DB="$TARGET_SUPERX_DIR/db"
    TARGET_SQL_ENV="$TARGET_DB/bin/SQL_ENV"
    SOURCE_DB_REAL="$(canon_path "$SOURCE_DB")"
    TARGET_DB_REAL="$(canon_path "$TARGET_DB")"
    TARGET_WEBAPP_REAL="$(canon_path "$TARGET_WEBAPP")"
    TARGET_WEBAPP_PARENT="$(dirname "$TARGET_WEBAPP")"
    TARGET_WEBAPP_PARENT_REAL="$(canon_path "$TARGET_WEBAPP_PARENT")"
    TOMCAT_SYMLINK_PATH="$TOMCAT_WEBAPPS_DIR/$TOMCAT_CONTEXT_NAME"
}

normalize_owner_mode() {
    EFFECTIVE_SET_OWNER="$SET_OWNER"
    EFFECTIVE_SET_GROUP="false"

    if ! is_true "$SET_RIGHTS"; then
        EFFECTIVE_SET_OWNER="false"
        EFFECTIVE_SET_GROUP="false"
        return 0
    fi

    if is_false "$SET_OWNER"; then
        EFFECTIVE_SET_OWNER="false"
        if current_user_matches_target; then
            EFFECTIVE_SET_GROUP="true"
        fi
        return 0
    fi

    if is_auto "$SET_OWNER"; then
        if is_root; then
            EFFECTIVE_SET_OWNER="true"
            EFFECTIVE_SET_GROUP="false"
            return 0
        fi

        if current_user_matches_target; then
            EFFECTIVE_SET_OWNER="false"
            EFFECTIVE_SET_GROUP="true"
            log "SET_OWNER=auto: chown wird uebersprungen, weil laufender User '$WEBAPP_USER' ist und zur Gruppe '$WEBAPP_GROUP' gehoert. Gruppe wird bei Bedarf per chgrp gesetzt."
            return 0
        fi

        EFFECTIVE_SET_OWNER="true"
        EFFECTIVE_SET_GROUP="false"
        return 0
    fi

    if is_true "$SET_OWNER"; then
        EFFECTIVE_SET_OWNER="true"
        EFFECTIVE_SET_GROUP="false"
        return 0
    fi
}

root_needed_reasons() {
    local reasons=()
    is_true "$STOP_TOMCAT" && reasons+=("STOP_TOMCAT=true")
    is_true "$START_TOMCAT" && reasons+=("START_TOMCAT=true")
    is_true "$CREATE_GROUP_IF_MISSING" && ! group_exists "$WEBAPP_GROUP" && reasons+=("CREATE_GROUP_IF_MISSING=true und Gruppe '$WEBAPP_GROUP' fehlt")
    if is_true "$ADD_WEBAPP_USER_TO_GROUP" && user_exists "$WEBAPP_USER" && group_exists "$WEBAPP_GROUP" && ! user_in_group "$WEBAPP_USER" "$WEBAPP_GROUP"; then
        reasons+=("ADD_WEBAPP_USER_TO_GROUP=true und '$WEBAPP_USER' ist noch nicht in Gruppe '$WEBAPP_GROUP'")
    fi
    is_true "$SET_RIGHTS" && is_true "$EFFECTIVE_SET_OWNER" && reasons+=("chown auf '$WEBAPP_USER:$WEBAPP_GROUP'")
    if is_true "$CREATE_TOMCAT_SYMLINK" && [ -d "$TOMCAT_WEBAPPS_DIR" ] && [ ! -w "$TOMCAT_WEBAPPS_DIR" ]; then
        reasons+=("CREATE_TOMCAT_SYMLINK=true und TOMCAT_WEBAPPS_DIR ist nicht beschreibbar: $TOMCAT_WEBAPPS_DIR")
    fi
    [ "${#reasons[@]}" -gt 0 ] && printf '%s\n' "${reasons[@]}" && return 0
    return 1
}

validate_privileges() {
    normalize_owner_mode
    is_root && return 0
    local reasons
    if reasons="$(root_needed_reasons)"; then
        fail "Dieses Skript laeuft nicht als root, aber folgende Aktionen brauchen root-Rechte:

$reasons"
    fi
}

print_summary() {
    cat <<EOF_SUM

=== SuperX Migration Tool $SCRIPT_VERSION ===

Config:
  CONFIG_FILE              = $CONFIG_FILE
  DRY_RUN                  = $DRY_RUN
  RUNNING_AS               = $(current_user)
  IS_ROOT                  = $(is_root && echo true || echo false)

Modus:
  MIGRATION_MODE           = $MIGRATION_MODE
  DB_TRANSFER_MODE         = $DB_TRANSFER_MODE

Quelle:
  SQL_ENV                  = $SQL_ENV
  SOURCE_TYPE              = $SOURCE_TYPE
  SOURCE_SUPERX_DIR        = $SOURCE_SUPERX_DIR
  SOURCE_WEBAPP            = $SOURCE_WEBAPP
  SOURCE_DB                = $SOURCE_DB

Ziel:
  TARGET_WEBAPP            = $TARGET_WEBAPP
  TARGET_SUPERX_DIR        = $TARGET_SUPERX_DIR
  TARGET_DB                = $TARGET_DB
  TARGET_SQL_ENV           = $TARGET_SQL_ENV

Symlink:
  CREATE_TOMCAT_SYMLINK    = $CREATE_TOMCAT_SYMLINK
  TOMCAT_WEBAPPS_DIR       = $TOMCAT_WEBAPPS_DIR
  TOMCAT_CONTEXT_NAME      = $TOMCAT_CONTEXT_NAME
  TOMCAT_SYMLINK_PATH      = $TOMCAT_SYMLINK_PATH
  REPLACE_EXISTING_SYMLINK = $REPLACE_EXISTING_SYMLINK

Rechte:
  WEBAPP_USER              = $WEBAPP_USER
  WEBAPP_GROUP             = $WEBAPP_GROUP
  SET_RIGHTS               = $SET_RIGHTS
  SET_OWNER                = $SET_OWNER
  EFFECTIVE_SET_OWNER      = $EFFECTIVE_SET_OWNER
  EFFECTIVE_SET_GROUP      = $EFFECTIVE_SET_GROUP
  SET_CHMOD                = $SET_CHMOD

========================================

EOF_SUM
}

validate_users_and_groups() {
    user_exists "$WEBAPP_USER" || fail "WEBAPP_USER existiert nicht: $WEBAPP_USER"
    if ! group_exists "$WEBAPP_GROUP"; then
        if is_true "$CREATE_GROUP_IF_MISSING"; then run "groupadd '$WEBAPP_GROUP'"; else fail "Gruppe existiert nicht: $WEBAPP_GROUP"; fi
    fi
    if is_true "$ADD_WEBAPP_USER_TO_GROUP"; then
        if user_in_group "$WEBAPP_USER" "$WEBAPP_GROUP"; then
            log "WEBAPP_USER '$WEBAPP_USER' ist bereits Mitglied der Gruppe '$WEBAPP_GROUP'."
        else
            run "usermod -aG '$WEBAPP_GROUP' '$WEBAPP_USER'"
            warn "Falls ein Dienst mit diesem User laeuft, muss er neu gestartet werden, damit die neue Gruppenmitgliedschaft aktiv wird."
        fi
    fi
}

validate_target() {
    [ "$TARGET_WEBAPP" = "$SOURCE_WEBAPP" ] && [ "$MIGRATION_MODE" = "full" ] && fail "TARGET_WEBAPP darf bei MIGRATION_MODE=full nicht identisch mit SOURCE_WEBAPP sein."
    [ -e "$TARGET_WEBAPP" ] && [ ! -d "$TARGET_WEBAPP" ] && fail "TARGET_WEBAPP existiert, ist aber kein Verzeichnis: $TARGET_WEBAPP"
    [ "$MIGRATION_MODE" = "full" ] && [ -d "$TARGET_WEBAPP/WEB-INF" ] && ! is_true "$ALLOW_EXISTING_TARGET" && fail "Ziel-Webapp existiert bereits: $TARGET_WEBAPP"
    [ "$SOURCE_DB_REAL" = "$TARGET_DB_REAL" ] && fail "SOURCE_DB und TARGET_DB sind identisch."
    case "$TARGET_DB_REAL" in "$SOURCE_DB_REAL"/*) fail "TARGET_DB liegt innerhalb von SOURCE_DB.";; esac
    case "$SOURCE_DB_REAL" in "$TARGET_DB_REAL"/*) fail "SOURCE_DB liegt innerhalb von TARGET_DB.";; esac
    [ "$DB_TRANSFER_MODE" = "move" ] && [ -e "$TARGET_DB" ] && fail "DB_TRANSFER_MODE=move, aber TARGET_DB existiert bereits: $TARGET_DB"
    [ "$DB_TRANSFER_MODE" = "copy" ] && [ -e "$TARGET_DB" ] && ! is_true "$ALLOW_EXISTING_TARGET_DB" && fail "TARGET_DB existiert bereits: $TARGET_DB"
    if is_true "$CREATE_TOMCAT_SYMLINK" && { [ -e "$TOMCAT_SYMLINK_PATH" ] || [ -L "$TOMCAT_SYMLINK_PATH" ]; }; then
        if [ -L "$TOMCAT_SYMLINK_PATH" ] && is_true "$REPLACE_EXISTING_SYMLINK"; then :; else
            fail "Tomcat-Symlink/Ziel existiert bereits: $TOMCAT_SYMLINK_PATH"
        fi
    fi
}

stop_tomcat_if_requested() {
    if is_true "$STOP_TOMCAT"; then
        command -v systemctl >/dev/null 2>&1 || fail "systemctl nicht gefunden, kann Tomcat nicht stoppen."
        run "systemctl stop '$TOMCAT_SERVICE'"
    fi
}

start_tomcat_if_requested() {
    if is_true "$START_TOMCAT"; then
        command -v systemctl >/dev/null 2>&1 || fail "systemctl nicht gefunden, kann Tomcat nicht starten."
        run "systemctl start '$TOMCAT_SERVICE'"
    fi
}

copy_webapp_if_requested() {
    [ "$MIGRATION_MODE" != "full" ] && { log "MIGRATION_MODE=db_only: Webapp wird nicht kopiert."; return 0; }
    command -v rsync >/dev/null 2>&1 || fail "rsync ist nicht installiert oder nicht im PATH."
    run "mkdir -p '$TARGET_WEBAPP'"
    RSYNC_DELETE=""; is_true "$DELETE_TARGET" && RSYNC_DELETE="--delete"
    log "Kopiere Webapp..."
    run "rsync -a $RSYNC_DELETE '$SOURCE_WEBAPP/' '$TARGET_WEBAPP/'"
}

transfer_db() {
    run "mkdir -p '$TARGET_SUPERX_DIR'"
    if [ "$DB_TRANSFER_MODE" = "copy" ]; then
        command -v rsync >/dev/null 2>&1 || fail "rsync ist nicht installiert oder nicht im PATH."
        RSYNC_DELETE=""; is_true "$DELETE_TARGET" && RSYNC_DELETE="--delete"
        log "Kopiere DB-Verzeichnis nach WEB-INF/conf/edustore/db..."
        run "mkdir -p '$TARGET_DB'"
        run "rsync -a $RSYNC_DELETE '$SOURCE_DB/' '$TARGET_DB/'"
    else
        log "Verschiebe DB-Verzeichnis nach WEB-INF/conf/edustore/db..."
        run "mkdir -p '$(dirname "$TARGET_DB")'"
        run "mv '$SOURCE_DB' '$TARGET_DB'"
    fi
}

backup_target_sql_env() {
    if [ -f "$TARGET_SQL_ENV" ]; then
        TS="$(date +%Y%m%d_%H%M%S)"
        run "cp -p '$TARGET_SQL_ENV' '$TARGET_SQL_ENV.bak.$TS'"
    else
        warn "Ziel-SQL_ENV existiert noch nicht: $TARGET_SQL_ENV"
    fi
}

update_target_sql_env() {
    is_true "$UPDATE_SQL_ENV" || return 0
    [ -f "$TARGET_SQL_ENV" ] || fail "Ziel-SQL_ENV nicht gefunden: $TARGET_SQL_ENV"
    backup_target_sql_env
    if is_true "$DRY_RUN"; then echo "[DRY-RUN] passe SQL_ENV an: $TARGET_SQL_ENV"; return 0; fi
    python3 - "$TARGET_SQL_ENV" "$TARGET_SUPERX_DIR" "$TARGET_WEBAPP" <<'PY'
from pathlib import Path
import re, sys
path = Path(sys.argv[1]); new_superx_dir = sys.argv[2]; new_webapp = sys.argv[3]
lines = path.read_text(encoding='utf-8', errors='surrogateescape').splitlines()
out=[]; seen_umask=seen_superx=seen_webapp=seen_export_superx=seen_export_webapp=False
for line in lines:
    s=line.strip()
    if re.match(r'^umask\s+', s):
        if not seen_umask: out.append('umask 002'); seen_umask=True
        else: out.append('# '+line)
    elif re.match(r'^SUPERX_DIR\s*=', s):
        if not seen_superx: out.append(f'SUPERX_DIR="{new_superx_dir}"'); seen_superx=True
        else: out.append('# '+line)
    elif re.match(r'^WEBAPP\s*=', s):
        if not seen_webapp: out.append(f'WEBAPP="{new_webapp}"'); seen_webapp=True
        else: out.append('# '+line)
    elif re.match(r'^export\s+SUPERX_DIR\b', s):
        seen_export_superx=True; out.append(line)
    elif re.match(r'^export\s+WEBAPP\b', s):
        seen_export_webapp=True; out.append(line)
    else: out.append(line)
insert=[]
if not seen_umask: insert.append('umask 002')
if not seen_superx: insert.append(f'SUPERX_DIR="{new_superx_dir}"')
if not seen_export_superx: insert.append('export SUPERX_DIR')
if not seen_webapp: insert.append(f'WEBAPP="{new_webapp}"')
if not seen_export_webapp: insert.append('export WEBAPP')
if insert: out = insert + [''] + out
path.write_text('\n'.join(out)+'\n', encoding='utf-8', errors='surrogateescape')
PY
}

set_rights() {
    if ! is_true "$SET_RIGHTS"; then
        log "Rechte setzen ist deaktiviert."
        return 0
    fi

    [ -d "$TARGET_WEBAPP" ] || fail "TARGET_WEBAPP fehlt: $TARGET_WEBAPP"

    log "Setze Rechte fuer Ziel-Webapp und Elternverzeichnis..."

    if is_true "$EFFECTIVE_SET_OWNER"; then
        log "Setze Owner/Gruppe rekursiv fuer TARGET_WEBAPP..."
        run "chown -R '$WEBAPP_USER:$WEBAPP_GROUP' '$TARGET_WEBAPP'"

        if [ -d "$TARGET_WEBAPP_PARENT" ]; then
            log "Setze Owner/Gruppe fuer TARGET_WEBAPP_PARENT..."
            run "chown '$WEBAPP_USER:$WEBAPP_GROUP' '$TARGET_WEBAPP_PARENT'"
        fi
    else
        log "Owner wird nicht gesetzt."

        if is_true "$EFFECTIVE_SET_GROUP"; then
            log "Setze Gruppe rekursiv per chgrp fuer TARGET_WEBAPP..."
            run "chgrp -R '$WEBAPP_GROUP' '$TARGET_WEBAPP'"

            if [ -d "$TARGET_WEBAPP_PARENT" ]; then
                log "Setze Gruppe fuer TARGET_WEBAPP_PARENT..."
                run "chgrp '$WEBAPP_GROUP' '$TARGET_WEBAPP_PARENT'"
            fi
        fi
    fi

    if is_true "$SET_CHMOD"; then
        log "Setze Rechte fuer TARGET_WEBAPP_PARENT..."
        if [ -d "$TARGET_WEBAPP_PARENT" ]; then
            run "chmod 2775 '$TARGET_WEBAPP_PARENT'"
        fi

        log "Setze Verzeichnisrechte mit setgid-Bit..."
        run "find '$TARGET_WEBAPP' -type d -exec chmod 2775 {} +"

        log "Setze Standard-Dateirechte..."
        run "find '$TARGET_WEBAPP' -type f -exec chmod 664 {} +"

        log "Setze ausfuehrbare Rechte fuer db/bin..."
        if [ -d "$TARGET_DB/bin" ]; then
            run "find '$TARGET_DB/bin' -type f -exec chmod 775 {} +"
        else
            warn "db/bin im Ziel nicht gefunden: $TARGET_DB/bin"
        fi

        log "Setze ausfuehrbare Rechte fuer *.x und *.sh..."
        run "find '$TARGET_WEBAPP' -type f \\( -name '*.x' -o -name '*.sh' \\) -exec chmod 775 {} +"
    else
        log "chmod ist deaktiviert."
    fi
}

create_tomcat_symlink_if_requested() {
    is_true "$CREATE_TOMCAT_SYMLINK" || { log "Tomcat-Symlink wird nicht erstellt."; return 0; }
    log "Erstelle Tomcat-Symlink..."
    run "mkdir -p '$TOMCAT_WEBAPPS_DIR'"
    [ -L "$TOMCAT_SYMLINK_PATH" ] && is_true "$REPLACE_EXISTING_SYMLINK" && run "rm '$TOMCAT_SYMLINK_PATH'"
    run "ln -s '$TARGET_WEBAPP' '$TOMCAT_SYMLINK_PATH'"
}

final_notes() {
    cat <<EOF_NOTE

Migration abgeschlossen.

Pruefen:
  ls -ld "$TARGET_WEBAPP_PARENT"
  ls -ld "$TARGET_WEBAPP"
  ls -ld "$TARGET_DB"
  ls -l  "$TARGET_DB/bin/SQL_ENV"
  . "$TARGET_SQL_ENV"
  echo \$SUPERX_DIR
  echo \$WEBAPP
EOF_NOTE
    is_true "$CREATE_TOMCAT_SYMLINK" && echo "  ls -l \"$TOMCAT_SYMLINK_PATH\""
    [ "$DB_TRANSFER_MODE" = "move" ] && warn "DB_TRANSFER_MODE=move wurde verwendet. Alte DB-Quelle wurde verschoben: $SOURCE_DB"
}

main() {
    load_config
    validate_basic_paths
    load_old_sql_env
    validate_privileges
    print_summary
    validate_users_and_groups
    validate_target
    stop_tomcat_if_requested
    copy_webapp_if_requested
    transfer_db
    update_target_sql_env
    set_rights
    create_tomcat_symlink_if_requested
    start_tomcat_if_requested
    final_notes
}
main "$@"