#!/usr/bin/env bash
set -euo pipefail

action="${1:-status}"
project_root="$(cd "$(dirname "$0")/.." && pwd)"
runtime_dir="$project_root/data/host-agent"
unit_name="codexpi-host-agent.service"
unit_source="$project_root/deploy/systemd/$unit_name"
unit_target="/etc/systemd/system/$unit_name"

status() {
  systemctl status "$unit_name" --no-pager || true
  if [[ -S "$runtime_dir/agent.sock" && -f "$runtime_dir/agent.token" ]]; then
    echo "Canal hôte CodexPi disponible."
  else
    echo "Canal hôte CodexPi non installé ou arrêté."
  fi
}

case "$action" in
  install)
    if [[ "${EUID}" -ne 0 ]]; then
      echo "Relancez avec sudo : sudo ./scripts/host-agent-channel.sh install" >&2
      exit 1
    fi
    install_user="${SUDO_USER:-$(id -un)}"
    install_group="$(id -gn "$install_user")"
    install -d -m 700 -o "$install_user" -g "$install_group" "$runtime_dir"
    if [[ ! -f "$runtime_dir/agent.token" ]]; then
      umask 077
      openssl rand -base64 48 > "$runtime_dir/agent.token"
      chown "$install_user:$install_group" "$runtime_dir/agent.token"
    fi
    chmod 600 "$runtime_dir/agent.token"
    temporary_unit="$(mktemp)"
    trap 'rm -f "$temporary_unit"' EXIT
    sed -e "s|__CODEXPI_USER__|$install_user|g" -e "s|__CODEXPI_GROUP__|$install_group|g" -e "s|__CODEXPI_ROOT__|$project_root|g" "$unit_source" > "$temporary_unit"
    install -m 644 "$temporary_unit" "$unit_target"
    systemctl daemon-reload
    systemctl enable --now "$unit_name"
    status
    ;;
  revoke)
    if [[ "${EUID}" -ne 0 ]]; then
      echo "Relancez avec sudo : sudo ./scripts/host-agent-channel.sh revoke" >&2
      exit 1
    fi
    systemctl disable --now "$unit_name" 2>/dev/null || true
    rm -f "$unit_target" "$runtime_dir/agent.sock" "$runtime_dir/agent.token"
    systemctl daemon-reload
    echo "Canal hôte révoqué; le jeton et le socket ont été supprimés."
    ;;
  status)
    status
    ;;
  *)
    echo "Usage : $0 {install|status|revoke}" >&2
    exit 2
    ;;
esac