#!/bin/bash
# ═══════════════════════════════════════════════════════════════════
# APOS Market — Первичная инициализация новой кассы (Linux Mint / Ubuntu)
# ═══════════════════════════════════════════════════════════════════

set -e

if [ "$(id -u)" -ne 0 ]; then
    echo "❌ Этот скрипт необходимо запускать через sudo: sudo bash $0"
    exit 1
fi

TARGET_USER="${SUDO_USER:-$(logname 2>/dev/null || echo 'kassa')}"
USER_HOME=$(getent passwd "$TARGET_USER" | cut -d: -f6)
if [ -z "$USER_HOME" ] || [ ! -d "$USER_HOME" ]; then
    USER_HOME="/home/$TARGET_USER"
fi

echo "🚀 [1/5] Настройка пользователя $TARGET_USER и прав NOPASSWD..."
echo "$TARGET_USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/99-pos-user
chmod 0440 /etc/sudoers.d/99-pos-user

echo "🌐 [2/5] Установка OpenSSH Server, curl, wget..."
apt-get update -y
apt-get install -y openssh-server curl wget net-tools
systemctl enable --now ssh

echo "🔑 [3/5] Добавление SSH-ключей APOS..."
add_keys_for_dir() {
    local target_dir="$1"
    local target_owner="$2"
    mkdir -p "$target_dir"
    cat << 'KEYS_EOF' >> "$target_dir/authorized_keys"
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICV6xCHkTKZMT2rOlMQPKsR/N9XgEZC9ElfmBy2PZT4l admin@apos-mac
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJCnrIEmmeavxS8lvNn5CCFrsK+EdkbWecp1d4WX0zof root@lygjplkfbx
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKcOmPHgE2IGTFgkwLVwQaMEUI68mNaQipieARu8yWDsj/CcjDEQ8ygBedBdkJNV1LgRhilr4mzZYaibjDaZVES6jXB/XrgKOezf/QZ3Xi+npviAwjRHTiCFLRmYskX867c/Po4cehODEGDK5j0F63x4O+fjP09Y2fv7+1sPi5vVPiJ1OgDwBVfmshjbWRpes1NUZuPSp3v8VIOfhN/UA7ELudr7FmLfozovKsi47MDKDlD9TU8fOAUSVsymAxz1T3PkQxoCduMCWLTBxJPe2+HkIXER+2G5iv/xmzhkcCHUszsjjFBya/JzPNl/p/ZakYzfWgUJPKosStzfcadSHB root@lygjplkfbx
KEYS_EOF
    sort -u "$target_dir/authorized_keys" -o "$target_dir/authorized_keys"
    chmod 700 "$target_dir"
    chmod 600 "$target_dir/authorized_keys"
    chown -R "$target_owner" "$target_dir"
}

add_keys_for_dir "$USER_HOME/.ssh" "$TARGET_USER:$TARGET_USER"
add_keys_for_dir "/root/.ssh" "root:root"

echo "⚙️  [4/5] Настройка политик тихих автообновлений (Sudoers & Polkit)..."
cat > /etc/sudoers.d/apos-updater << 'SUDO_EOF'
ALL ALL=(ALL) NOPASSWD: /usr/bin/dpkg -i /tmp/apos-update.deb, /usr/bin/dpkg -i /tmp/*.deb, /opt/apos/scripts/install-update.sh, /bin/systemctl restart apos-market, /bin/systemctl restart apos-market.service, /usr/bin/pkill -f apos-market
SUDO_EOF
chmod 0440 /etc/sudoers.d/apos-updater

mkdir -p /etc/polkit-1/localrules.d 2>/dev/null || true
cat > /etc/polkit-1/localrules.d/50-apos-updater.rules << 'POLKIT_EOF'
/* APOS Market PolicyKit rule for silent background OTA updates */
polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.packagekit.system-update" ||
         action.id == "org.freedesktop.dpkg.pkexec" ||
         action.id == "org.freedesktop.policykit.exec") &&
        (action.lookup("command_line") && action.lookup("command_line").indexOf("install-update.sh") !== -1 ||
         action.lookup("command_line") && action.lookup("command_line").indexOf("apos-update") !== -1)) {
        return polkit.Result.YES;
    }
});
POLKIT_EOF
chmod 0644 /etc/polkit-1/localrules.d/50-apos-updater.rules 2>/dev/null || true

mkdir -p /opt/apos/scripts 2>/dev/null || true
cat > /opt/apos/scripts/install-update.sh << 'UPD_EOF'
#!/bin/bash
set -e
UPDATE_DEB="/tmp/apos-update.deb"
UPDATE_APPIMAGE="/tmp/apos-update.AppImage"
LOG_FILE="/var/log/apos-updater.log"

echo "[$(date '+%Y-%m-%d %H:%M:%S')] 🚀 Запуск тихой установки обновления..." >> "$LOG_FILE"
if [ -f "$UPDATE_DEB" ]; then
    /usr/bin/dpkg -i "$UPDATE_DEB" >> "$LOG_FILE" 2>&1 || true
    rm -f "$UPDATE_DEB" 2>/dev/null || true
elif [ -f "$UPDATE_APPIMAGE" ]; then
    chmod +x "$UPDATE_APPIMAGE"
    cp -f "$UPDATE_APPIMAGE" /opt/apos/apos-market.AppImage
    rm -f "$UPDATE_APPIMAGE" 2>/dev/null || true
fi

if systemctl is-active --quiet apos-market 2>/dev/null; then
    systemctl restart apos-market >> "$LOG_FILE" 2>&1 || true
else
    pkill -f apos-market || true
fi
UPD_EOF
chmod +x /opt/apos/scripts/install-update.sh
touch /var/log/apos-updater.log 2>/dev/null || true
chmod 666 /var/log/apos-updater.log 2>/dev/null || true

mkdir -p "/opt/APOS Market/resources" 2>/dev/null || true
chmod -R 777 "/opt/APOS Market" 2>/dev/null || true

echo "🖥️  [5/5] Установка и запуск RustDesk..."
wget -q -O /tmp/rustdesk.deb http://194.156.117.173/apos-updates/rustdesk-1.3.8-x86_64.deb
dpkg -i /tmp/rustdesk.deb >/dev/null 2>&1 || apt-get install -f -y >/dev/null 2>&1
systemctl enable --now rustdesk >/dev/null 2>&1 || true
rustdesk --password Gagra2023 2>/dev/null || true
rm -f /tmp/rustdesk.deb

sleep 2
RD_ID=$(rustdesk --get-id 2>/dev/null | tr -d '[:space:]' || true)
if [ -z "$RD_ID" ]; then
    RD_ID=$(grep -oP "id\s*=\s*'\K[0-9]+" /root/.config/rustdesk/RustDesk.toml 2>/dev/null || true)
fi

echo ""
echo "═══════════════════════════════════════════════════════════════"
echo "🎉 ГОТОВО! Касса успешно настроена для удалённого подключения!"
echo "═══════════════════════════════════════════════════════════════"
echo "🔑 SSH доступ открыт для пользователя: $TARGET_USER"
echo "🛡️ Беспарольный sudo (NOPASSWD) и автообновление настроены!"
if [ -n "$RD_ID" ]; then
    echo "🆔 RustDesk ID: $RD_ID  (пароль: Gagra2023)"
else
    echo "🆔 RustDesk установлен и запущен (пароль: Gagra2023)"
fi
echo "═══════════════════════════════════════════════════════════════"