#!/usr/bin/env bash
set -euo pipefail
requested="${1:-}"
case "$requested" in /home/*|/mnt/*|/media/*|/srv/*|/var/lib/gesundheitsbelege/projects/*) ;; *) exit 10 ;; esac
[ "${#requested}" -le 500 ] || exit 11
parent_requested="$(dirname -- "$requested")"
name="$(basename -- "$requested")"
[[ "$name" != "." && "$name" != ".." && "$name" != *$'\n'* && "$name" != *$'\r'* ]] || exit 12
parent="$(realpath -e -- "$parent_requested")"
[ -d "$parent" ] && [ ! -L "$parent" ] || exit 13
case "$parent" in /home|/home/*|/mnt|/mnt/*|/media|/media/*|/srv|/srv/*|/var/lib/gesundheitsbelege/projects|/var/lib/gesundheitsbelege/projects/*) ;; *) exit 14 ;; esac
target="$parent/$name"
mkdir -p -- "$target"
[ -d "$target" ] && [ ! -L "$target" ] || exit 15
ancestor="$parent"
while [ "$ancestor" != "/" ]; do setfacl -m u:www-data:--x -- "$ancestor"; ancestor="$(dirname -- "$ancestor")"; done
find "$target" -xdev -type d -exec setfacl -m u:www-data:rwx,d:u:www-data:rwx -- {} +
find "$target" -xdev -type f -exec setfacl -m u:www-data:rw- -- {} +
printf '%s\n' "$target"