#!/bin/bash
set -euo pipefail

# Officer Remote Desktop Setup
# Run as the user who will own the VNC session (not root).
# Usage: ./scripts/setup-desktop.sh <vnc-password> [resolution]

if [ $# -lt 1 ]; then
  echo "Usage: $0 <vnc-password> [resolution]"
  echo "  vnc-password: 8 characters max (VNC protocol limitation)"
  echo "  resolution:   optional, default 1920x1080"
  exit 1
fi

VNC_PASS="$1"
RESOLUTION="${2:-1920x1080}"
USER_NAME="$(whoami)"
ENV_FILE="$(cd "$(dirname "$0")/.." && pwd)/.env"

echo "=== Officer Remote Desktop Setup ==="
echo "User:       $USER_NAME"
echo "Resolution: $RESOLUTION"
echo ""

# --- Step 1: Install system packages ---
echo "[1/8] Installing system packages..."
sudo apt update -qq
sudo apt install -y -qq \
  xfce4 xfce4-goodies \
  tigervnc-standalone-server tigervnc-common \
  dbus-x11 \
  > /dev/null 2>&1
echo "  Done."

# --- Step 2: Install Brave browser (native .deb, not snap) ---
echo "[2/8] Installing Brave browser..."
if ! command -v brave-browser-stable > /dev/null 2>&1; then
  sudo curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg \
    https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
  echo "deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main" \
    | sudo tee /etc/apt/sources.list.d/brave-browser-release.list > /dev/null
  sudo apt update -qq
  sudo apt install -y -qq brave-browser > /dev/null 2>&1
fi
# Fix launcher symlink (the installed /usr/bin/brave-browser-stable is a copy
# that breaks because $HERE resolves to /usr/bin instead of /opt/brave.com/brave)
if [ -f /opt/brave.com/brave/brave-browser ]; then
  sudo rm -f /usr/bin/brave-browser-stable
  sudo ln -s /opt/brave.com/brave/brave-browser /usr/bin/brave-browser-stable
fi
# Tell Brave to use basic password store (no GNOME Keyring prompts)
sudo mkdir -p /etc/brave
echo '--password-store=basic' | sudo tee /etc/brave/brave-flags.conf > /dev/null
echo "  Done."

# --- Step 3: Configure VNC password ---
echo "[3/8] Configuring VNC password..."
mkdir -p ~/.vnc
echo "$VNC_PASS" | vncpasswd -f > ~/.vnc/passwd
chmod 600 ~/.vnc/passwd
echo "  Done."

# --- Step 4: Create xstartup ---
echo "[4/8] Creating VNC xstartup..."
cat > ~/.vnc/xstartup << 'XSTARTUP'
#!/bin/sh
unset SESSION_MANAGER
unset DBUS_SESSION_BUS_ADDRESS
eval $(dbus-launch --sh-syntax)
export DBUS_SESSION_BUS_ADDRESS
exec startxfce4
XSTARTUP
chmod +x ~/.vnc/xstartup
echo "  Done."

# --- Step 5: Remove GNOME Keyring (prevents password prompts on login) ---
echo "[5/8] Removing GNOME Keyring..."
sudo apt remove -y --purge gnome-keyring > /dev/null 2>&1 || true
rm -rf ~/.local/share/keyrings
echo "  Done."

# --- Step 6: Create systemd service ---
echo "[6/8] Creating systemd service..."
sudo tee /etc/systemd/system/officer-vnc.service > /dev/null << EOF
[Unit]
Description=TigerVNC Server for Officer Remote Desktop
After=syslog.target network.target

[Service]
Type=simple
User=$USER_NAME
ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill :1 > /dev/null 2>&1 || true'
ExecStart=/usr/bin/vncserver :1 -geometry $RESOLUTION -depth 24 -localhost yes -fg
ExecStop=/usr/bin/vncserver -kill :1
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now officer-vnc
echo "  Done."

# --- Step 7: Set default browser ---
echo "[7/8] Setting default browser..."
sleep 2  # Wait for VNC session to start
if command -v brave-browser-stable > /dev/null 2>&1; then
  sudo update-alternatives --set x-www-browser /opt/brave.com/brave/brave 2>/dev/null || true
  DISPLAY=:1 xdg-settings set default-web-browser brave-browser.desktop 2>/dev/null || true
  echo "  Brave set as default."
else
  echo "  No supported browser found, skipping."
fi

# --- Step 8: Add env vars ---
echo "[8/8] Updating .env..."
if [ -f "$ENV_FILE" ]; then
  grep -q '^VNC_PASSWORD=' "$ENV_FILE" && sed -i "s/^VNC_PASSWORD=.*/VNC_PASSWORD=$VNC_PASS/" "$ENV_FILE" || echo "VNC_PASSWORD=$VNC_PASS" >> "$ENV_FILE"
  grep -q '^VNC_PORT=' "$ENV_FILE" && sed -i "s/^VNC_PORT=.*/VNC_PORT=5901/" "$ENV_FILE" || echo "VNC_PORT=5901" >> "$ENV_FILE"
else
  echo "VNC_PASSWORD=$VNC_PASS" >> "$ENV_FILE"
  echo "VNC_PORT=5901" >> "$ENV_FILE"
fi
echo "  Done."

# --- Verify ---
echo ""
echo "=== Verification ==="
sleep 2
if systemctl is-active --quiet officer-vnc; then
  echo "VNC service: running"
else
  echo "VNC service: FAILED — check 'journalctl -u officer-vnc'"
fi

LISTEN=$(ss -tlnp | grep 5901 | head -1)
if echo "$LISTEN" | grep -q '127.0.0.1'; then
  echo "VNC binding: localhost only (secure)"
else
  echo "VNC binding: WARNING — check 'ss -tlnp | grep 5901'"
fi

echo ""
echo "Setup complete. Restart the Officer server and navigate to /desktop."