#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SOURCE_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"

SERVICE_NAME="${SERVICE_NAME:-skd}"
SERVICE_USER="${SERVICE_USER:-skd}"
SERVICE_GROUP="${SERVICE_GROUP:-$SERVICE_USER}"
INSTALL_DIR="${INSTALL_DIR:-/opt/sk}"
ENV_DIR="/etc/${SERVICE_NAME}"
ENV_FILE="${ENV_DIR}/env"
SYSTEMD_PATH="/etc/systemd/system/${SERVICE_NAME}.service"

log() {
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"
}

require_cmd() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo "Required command not found: $1" >&2
    exit 1
  fi
}

log "Ensuring service user/group (${SERVICE_USER}) exist..."
if ! getent group "${SERVICE_GROUP}" >/dev/null 2>&1; then
  sudo groupadd -r "${SERVICE_GROUP}"
fi
if ! id -u "${SERVICE_USER}" >/dev/null 2>&1; then
  sudo useradd -r -s /usr/sbin/nologin -d "${INSTALL_DIR}" -g "${SERVICE_GROUP}" "${SERVICE_USER}"
  log "Created system user ${SERVICE_USER}"
fi

require_cmd rsync

log "Syncing project to ${INSTALL_DIR}..."
sudo mkdir -p "${INSTALL_DIR}"
sudo rsync -a --delete --exclude '.venv' "${SOURCE_DIR}/" "${INSTALL_DIR}/"
sudo chown -R "${SERVICE_USER}:${SERVICE_GROUP}" "${INSTALL_DIR}"

log "Creating/refreshing virtualenv in ${INSTALL_DIR}..."
sudo -u "${SERVICE_USER}" PROJECT_ROOT="${INSTALL_DIR}" "${SOURCE_DIR}/scripts/create_venv.sh"

log "Preparing environment file..."
sudo mkdir -p "${ENV_DIR}"
if [[ ! -f "${ENV_FILE}" ]]; then
  if [[ -f "${SOURCE_DIR}/env.example" ]]; then
    sudo cp "${SOURCE_DIR}/env.example" "${ENV_FILE}"
    log "Copied env.example to ${ENV_FILE}; edit SKD_AUTH_TOKEN and SKD_ALLOWED_USERS."
  else
    sudo touch "${ENV_FILE}"
    log "Created empty ${ENV_FILE}; populate required variables."
  fi
  sudo chmod 640 "${ENV_FILE}"
  sudo chown root:"${SERVICE_GROUP}" "${ENV_FILE}"
fi

log "Ensuring minimal ENV defaults (PAM always on, allowed user)..."
DEFAULT_USER="${SUDO_USER:-}"
if [[ -n "${DEFAULT_USER}" ]]; then
  if ! sudo grep -q "^SKD_AUTH_ALLOWED_USERS=" "${ENV_FILE}"; then
    echo "SKD_AUTH_ALLOWED_USERS=${DEFAULT_USER}" | sudo tee -a "${ENV_FILE}" >/dev/null
  fi
fi
if ! sudo grep -q "^SKD_AUTH_MODE=" "${ENV_FILE}"; then
  echo "SKD_AUTH_MODE=pam" | sudo tee -a "${ENV_FILE}" >/dev/null
fi

log "Writing systemd unit to ${SYSTEMD_PATH}..."
sudo tee "${SYSTEMD_PATH}" >/dev/null <<EOF
[Unit]
Description=Safe Kiddo Daemon
After=network.target

[Service]
Type=simple
User=${SERVICE_USER}
Group=${SERVICE_GROUP}
WorkingDirectory=${INSTALL_DIR}
EnvironmentFile=${ENV_FILE}
ExecStart=${INSTALL_DIR}/.venv/bin/uvicorn backend.app:app --host 0.0.0.0 --port 8000
Restart=on-failure
RestartSec=3

[Install]
WantedBy=multi-user.target
EOF

log "Enabling and starting service..."
sudo systemctl daemon-reload
sudo systemctl enable "${SERVICE_NAME}.service"
sudo systemctl restart "${SERVICE_NAME}.service"

log "Installation finished. Check status: sudo systemctl status ${SERVICE_NAME}.service"