#!/usr/bin/env bash

set -euo pipefail
IFS=$'\n\t'

SCRIPT_NAME="$(basename "$0")"
CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/control-from-mobile"
STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/control-from-mobile"
PASSWORD_FILE="$CONFIG_DIR/vnc.pass"
ENV_FILE="$CONFIG_DIR/env"
RUNNER_FILE="$CONFIG_DIR/start-x11vnc.sh"
SERVICE_NAME="control-from-mobile.service"
SYSTEMD_USER_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
SERVICE_FILE="$SYSTEMD_USER_DIR/$SERVICE_NAME"
DEFAULT_DISPLAY="${DISPLAY:-:0}"
DEFAULT_PORT=5901
DEFAULT_BIND_ADDR="0.0.0.0"
readonly SCRIPT_NAME CONFIG_DIR STATE_DIR PASSWORD_FILE ENV_FILE RUNNER_FILE SERVICE_NAME SYSTEMD_USER_DIR SERVICE_FILE DEFAULT_DISPLAY DEFAULT_PORT DEFAULT_BIND_ADDR

usage() {
  cat << 'EOF'
Usage: control_from_mobile.sh <command> [options]

Commands:
	setup [--force-password]  Install dependencies, create configs, and write the systemd user service.
	start                     Start the VNC bridge (via systemd user unit when available).
	stop                      Stop the bridge.
	restart                   Restart the bridge.
	status                    Show whether the bridge service is running.
	enable                    Enable the service so it starts after login.
	disable                   Disable automatic start after login.
	info                      Show connection details and Android app suggestions.
	uninstall                 Stop the service and remove generated files (keeps password unless --purge).
	help                      Show this message.

Options:
	--force-password          Regenerate the VNC password during setup.
	--purge                   Delete the stored VNC password during uninstall.

Examples:
	./control_from_mobile.sh setup
	./control_from_mobile.sh start
	./control_from_mobile.sh info

EOF
}

log() {
  printf '[%s] %s\n' "$SCRIPT_NAME" "$*"
}

warn() {
  printf '[%s] %s\n' "$SCRIPT_NAME" "$*" >&2
}

die() {
  warn "$*"
  exit 1
}

require_non_root() {
  if [[ ${EUID:-$(id -u)} -eq 0 ]]; then
    die "Run this script as a regular desktop user, not root."
  fi
}

prompt_yes_no() {
  local prompt="$1"
  local reply
  read -r -p "$prompt [y/N]: " reply
  case "$reply" in
    [Yy][Ee][Ss] | [Yy]) return 0 ;;
    *) return 1 ;;
  esac
}

ensure_directories() {
  mkdir -p "$CONFIG_DIR" "$STATE_DIR" "$SYSTEMD_USER_DIR"
  chmod 700 "$CONFIG_DIR"
}

missing_commands() {
  local missing=()
  for cmd in "$@"; do
    if ! command -v "$cmd" > /dev/null 2>&1; then
      missing+=("$cmd")
    fi
  done
  printf '%s\n' "${missing[@]-}"
}

install_dependencies() {
  if ! command -v systemctl > /dev/null 2>&1; then
    die "systemctl not found. Install systemd before running this script."
  fi

  local required=(x11vnc qrencode ssh)
  local needed=()
  mapfile -t needed < <(missing_commands "${required[@]}")
  if ((${#needed[@]} == 0)); then
    log "All required packages (${required[*]}) are present."
    return
  fi

  if command -v pacman > /dev/null 2>&1; then
    log "Installing missing packages: ${needed[*]}"
    sudo pacman -S --needed --noconfirm "${needed[@]}"
  else
    die "Missing commands (${needed[*]}). Install them manually and rerun setup."
  fi
}

create_password_file() {
  local force=${1:-0}
  if [[ -f $PASSWORD_FILE && $force -ne 1 ]]; then
    log "Using existing VNC password file at $PASSWORD_FILE"
    return
  fi

  if [[ -f $PASSWORD_FILE ]]; then
    if ! prompt_yes_no "Regenerate the stored VNC password?"; then
      log "Keeping existing password."
      return
    fi
  fi

  local password confirm generated=0
  read -rsp "Enter VNC password (leave blank to auto-generate): " password
  printf '\n'
  if [[ -z $password ]]; then
    generated=1
    password=$(LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 8)
    log "Generated VNC password: $password"
  else
    read -rsp "Confirm password: " confirm
    printf '\n'
    if [[ $password != "$confirm" ]]; then
      die "Passwords do not match."
    fi
  fi

  local tmp
  tmp=$(mktemp)
  x11vnc -storepasswd "$password" "$tmp" > /dev/null
  install -m 600 "$tmp" "$PASSWORD_FILE"
  rm -f "$tmp"

  if ((generated == 0)); then
    log "Password stored securely at $PASSWORD_FILE (hashed)."
  else
    log "Please write down the generated password; it will be needed on your Android device."
  fi
}

create_env_file() {
  if [[ -f $ENV_FILE ]]; then
    return
  fi
  cat > "$ENV_FILE" << EOF
# control-from-mobile configuration
# Adjust these values if needed and rerun: systemctl --user restart $SERVICE_NAME
X11_DISPLAY="$DEFAULT_DISPLAY"
VNC_PORT="$DEFAULT_PORT"
# Use 127.0.0.1 to force SSH tunnel-only access, or 0.0.0.0 to expose on LAN.
VNC_BIND_ADDR="$DEFAULT_BIND_ADDR"
EOF
  chmod 600 "$ENV_FILE"
}

create_runner_script() {
  cat > "$RUNNER_FILE" << 'EOF'
#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'

CONFIG_DIR="$(dirname "$(readlink -f "$0")")"
PASSWORD_FILE="$CONFIG_DIR/vnc.pass"
ENV_FILE="$CONFIG_DIR/env"
STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/control-from-mobile"
mkdir -p "$STATE_DIR"

if [[ ! -f "$PASSWORD_FILE" ]]; then
	echo "Missing VNC password file at $PASSWORD_FILE" >&2
	exit 1
fi

if [[ -f "$ENV_FILE" ]]; then
	# shellcheck disable=SC1090
	source "$ENV_FILE"
fi

X11_DISPLAY="${X11_DISPLAY:-${DISPLAY:-:0}}"
VNC_PORT="${VNC_PORT:-5901}"
VNC_BIND_ADDR="${VNC_BIND_ADDR:-0.0.0.0}"

LOG_FILE="$STATE_DIR/x11vnc.log"
exec /usr/bin/x11vnc \
	-display "$X11_DISPLAY" \
	-rfbport "$VNC_PORT" \
	-listen "$VNC_BIND_ADDR" \
	-forever \
	-shared \
	-auth guess \
	-rfbauth "$PASSWORD_FILE" \
	-noxdamage \
	-repeat \
	-ncache 10 \
	-ncache_cr \
	-o "$LOG_FILE"
EOF
  chmod 700 "$RUNNER_FILE"
}

create_service_file() {
  cat > "$SERVICE_FILE" << EOF
[Unit]
Description=Expose X11 desktop over VNC for Android control
After=graphical-session.target
PartOf=graphical-session.target

[Service]
Type=simple
EnvironmentFile=$ENV_FILE
ExecStart=$RUNNER_FILE
Restart=on-failure
RestartSec=2
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=default.target
EOF
}

reload_user_daemon() {
  systemctl --user daemon-reload
}

ensure_service_present() {
  if [[ ! -f $SERVICE_FILE || ! -x $RUNNER_FILE ]]; then
    die "Service files missing. Run: $SCRIPT_NAME setup"
  fi
}

start_service() {
  ensure_service_present
  systemctl --user start "$SERVICE_NAME"
}

stop_service() {
  systemctl --user stop "$SERVICE_NAME" || true
}

status_service() {
  if systemctl --user is-active --quiet "$SERVICE_NAME"; then
    log "Service is active."
  else
    log "Service is inactive."
  fi
  systemctl --user status "$SERVICE_NAME" --no-pager || true
}

enable_service() {
  ensure_service_present
  systemctl --user enable "$SERVICE_NAME"
}

disable_service() {
  systemctl --user disable "$SERVICE_NAME" || true
}

show_info() {
  ensure_service_present
  # shellcheck disable=SC1090
  [[ -f $ENV_FILE ]] && source "$ENV_FILE"
  local port="${VNC_PORT:-$DEFAULT_PORT}"
  local bind_addr="${VNC_BIND_ADDR:-$DEFAULT_BIND_ADDR}"
  local display="${X11_DISPLAY:-$DEFAULT_DISPLAY}"

  local is_active="inactive"
  if systemctl --user is-active --quiet "$SERVICE_NAME"; then
    is_active="active"
  fi

  log "Service status: $is_active"
  log "Display: $display"
  log "Listening address: $bind_addr"
  log "VNC port: $port"
  log "Password file: $PASSWORD_FILE"

  local -a ip_list=()
  if command -v hostname > /dev/null 2>&1; then
    while IFS= read -r line; do
      [[ -z $line ]] && continue
      ip_list+=("$line")
    done < <(hostname -I 2> /dev/null | tr ' ' '\n' | grep -E '^[0-9]' || true)
  fi

  if ((${#ip_list[@]} > 0)); then
    log "Detected LAN IPs:"
    for ip in "${ip_list[@]}"; do
      printf '  - %s\n' "$ip"
    done
  else
    warn "Could not detect LAN IPs."
  fi

  printf '\nRecommended Android clients (FOSS):\n'
  printf '  • bVNC (available on F-Droid) — supports full control.\n'
  printf '  • Termux + OpenSSH for establishing an SSH tunnel when exposing only on 127.0.0.1.\n'
  printf '\nConnect via VNC:\n'
  printf '  Host: <your-ip>\n  Port: %s\n  Password: <stored during setup>\n' "$port"

  local qr_host
  if ((${#ip_list[@]} > 0)); then
    qr_host="${ip_list[0]}"
  else
    qr_host="$bind_addr"
    if [[ $qr_host == "0.0.0.0" || $qr_host == "::" ]]; then
      qr_host="127.0.0.1"
    fi
    warn "Using fallback host $qr_host for QR code; replace with an accessible IP if needed."
  fi

  if command -v qrencode > /dev/null 2>&1; then
    printf '\nConnection QR (vnc://%s:%s):\n' "$qr_host" "$port"
    qrencode -o - "vnc://$qr_host:$port" -t ASCII || true
  else
    warn "qrencode not found; reinstall qrencode to get QR codes."
  fi

  printf '\nFor encrypted access outside your LAN, use Termux on Android:\n'
  printf '  ssh -L %s:localhost:%s <user>@<public-ip>\n' "$port" "$port"
  printf 'Then point bVNC to 127.0.0.1:%s.\n' "$port"
}

uninstall_files() {
  local purge_password=${1:-0}
  stop_service
  disable_service
  rm -f "$SERVICE_FILE"
  rm -f "$RUNNER_FILE"
  rm -f "$ENV_FILE"
  if ((purge_password)); then
    rm -f "$PASSWORD_FILE"
    log "Removed password file."
  fi
  reload_user_daemon
  log "Removed generated files."
}

main() {
  require_non_root

  local cmd="${1:-}"
  shift || true

  case "$cmd" in
    setup)
      local force=0
      if [[ ${1:-} == "--force-password" ]]; then
        force=1
        shift || true
      fi
      ensure_directories
      install_dependencies
      create_password_file "$force"
      create_env_file
      create_runner_script
      create_service_file
      reload_user_daemon
      log "Setup complete. Start the service with: $SCRIPT_NAME start"
      ;;
    start)
      start_service
      show_info
      ;;
    stop)
      stop_service
      ;;
    restart)
      stop_service
      start_service
      ;;
    status)
      status_service
      ;;
    enable)
      enable_service
      ;;
    disable)
      disable_service
      ;;
    info)
      show_info
      ;;
    uninstall)
      local purge=0
      if [[ ${1:-} == "--purge" ]]; then
        purge=1
        shift || true
      fi
      uninstall_files "$purge"
      ;;
    help | --help | -h | "")
      usage
      ;;
    *)
      usage
      die "Unknown command: $cmd"
      ;;
  esac
}

main "$@"