#!/bin/bash
set -euo pipefail

# Officer Remote Desktop Setup — System packages only.
# Per-user VNC config is handled by user provisioning (provision.ts).
# Usage: ./scripts/setup-desktop.sh

echo "=== Officer Remote Desktop Setup ==="
echo ""

# --- Step 1: Install system packages ---
echo "[1/4] Installing system packages..."
sudo apt update -qq
sudo DEBIAN_FRONTEND=noninteractive apt install -y -qq \
  xfce4 xfce4-goodies \
  tigervnc-standalone-server tigervnc-common \
  dbus-x11
echo "  Done."

# --- Step 2: Install Brave browser (native .deb, not snap) ---
echo "[2/4] Installing Brave browser..."
if ! command -v brave-browser-stable > /dev/null 2>&1; then
  sudo curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg \
    https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
  echo "deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main" \
    | sudo tee /etc/apt/sources.list.d/brave-browser-release.list > /dev/null
  sudo apt update -qq
  sudo DEBIAN_FRONTEND=noninteractive apt install -y -qq brave-browser
fi
# Fix launcher symlink
if [ -f /opt/brave.com/brave/brave-browser ]; then
  sudo rm -f /usr/bin/brave-browser-stable
  sudo ln -s /opt/brave.com/brave/brave-browser /usr/bin/brave-browser-stable
fi
# Tell Brave to use basic password store (no GNOME Keyring prompts)
sudo mkdir -p /etc/brave
echo '--password-store=basic' | sudo tee /etc/brave/brave-flags.conf > /dev/null
echo "  Done."

# --- Step 3: Remove GNOME Keyring (prevents password prompts on login) ---
echo "[3/4] Removing GNOME Keyring..."
sudo apt remove -y --purge gnome-keyring > /dev/null 2>&1 || true
rm -rf ~/.local/share/keyrings
echo "  Done."

# --- Step 4: Set default browser ---
echo "[4/4] Setting default browser..."
if command -v brave-browser-stable > /dev/null 2>&1; then
  sudo update-alternatives --set x-www-browser /opt/brave.com/brave/brave 2>/dev/null || true
  echo "  Brave set as default."
else
  echo "  No supported browser found, skipping."
fi

# --- Cleanup old systemd service if it exists ---
if systemctl list-unit-files officer-vnc.service &>/dev/null; then
  echo ""
  echo "Removing old officer-vnc systemd service..."
  sudo systemctl stop officer-vnc 2>/dev/null || true
  sudo systemctl disable officer-vnc 2>/dev/null || true
  sudo rm -f /etc/systemd/system/officer-vnc.service
  sudo systemctl daemon-reload
  echo "  Done."
fi

echo ""
echo "Setup complete. Per-user VNC sessions are managed by the VNC sidecar."