#!/usr/bin/env bash
set -euo pipefail

# ===============================
# Load environment
# ===============================
ENV_FILE="./.env"

if [[ ! -f "$ENV_FILE" ]]; then
    echo "ERROR: .env file not found. Copy .env.tmpl to .env and edit it."
    exit 1
fi

# shellcheck disable=SC1090
source "$ENV_FILE"

# ===============================
# Validate required variables
# ===============================
: "${BACKUP_USER:?missing}"
: "${PYTHON_BIN:?missing}"
: "${BACKUP_INSTALL_DIR:?missing}"
: "${BACKUP_RUNNER:?missing}"
: "${WRAPPER_PATH:?missing}"

RUNNER_PATH="$BACKUP_INSTALL_DIR/$BACKUP_RUNNER"
HOME_DIR="/home/$BACKUP_USER"

if [[ ! -x "$PYTHON_BIN" ]]; then
    echo "ERROR: Python binary not executable: $PYTHON_BIN"
    exit 1
fi

if [[ ! -f "$RUNNER_PATH" ]]; then
    echo "ERROR: Runner not found: $RUNNER_PATH"
    exit 1
fi

# ===============================
# Create user (no shell)
# ===============================
if ! id "$BACKUP_USER" >/dev/null 2>&1; then
    useradd -m -d "$HOME_DIR" -s /usr/sbin/nologin "$BACKUP_USER"
fi

# ===============================
# SSH setup
# ===============================
install -d -m 700 "$HOME_DIR/.ssh"
touch "$HOME_DIR/.ssh/authorized_keys"
chmod 600 "$HOME_DIR/.ssh/authorized_keys"
chown -R "$BACKUP_USER:$BACKUP_USER" "$HOME_DIR/.ssh"

# ===============================
# Create root-owned wrapper
# ===============================
cat > "$WRAPPER_PATH" <<EOF
#!/usr/bin/env bash
exec "$PYTHON_BIN" "$RUNNER_PATH"
EOF

chown root:root "$WRAPPER_PATH"
chmod 750 "$WRAPPER_PATH"

# ===============================
# Lock sudo to wrapper ONLY
# ===============================
SUDOERS_FILE="/etc/sudoers.d/$BACKUP_USER"

cat > "$SUDOERS_FILE" <<EOF
$BACKUP_USER ALL=(root) NOPASSWD: $WRAPPER_PATH
EOF

chmod 440 "$SUDOERS_FILE"

# ===============================
# Fix runner permissions
# ===============================
chown root:root "$RUNNER_PATH"
chmod 750 "$RUNNER_PATH"

# ===============================
# Output next steps
# ===============================
echo
echo "User '$BACKUP_USER' created and locked down."
echo
echo "NEXT STEP (manual): add SSH public key:"
echo
echo "command=\"sudo $WRAPPER_PATH\",no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding <SSH_PUBLIC_KEY>"
echo