#!/usr/bin/env bash
# Passwordless control plane for MetaVPN helper (invoked via sudo -n).
# Allowed verbs only — no shell, no arbitrary args.
set -euo pipefail

CMD="${1:-}"
case "$CMD" in
  ensure|restart)
    pkill -9 -f '/opt/metavpn/bin/xray' 2>/dev/null || true
    pkill -9 -f 'metavpn-xray-config' 2>/dev/null || true
    mkdir -p /var/lib/metavpn/trigger /etc/metavpn
    chmod 1777 /var/lib/metavpn/trigger 2>/dev/null || true
    if command -v systemctl >/dev/null 2>&1; then
      systemctl daemon-reload >/dev/null 2>&1 || true
      systemctl enable metavpn-xray-helper.service metavpn-xray-helper.path >/dev/null 2>&1 || true
      systemctl start metavpn-xray-helper.path >/dev/null 2>&1 || true
      systemctl restart metavpn-xray-helper.service || true
    fi
    helper_ok() {
      python3 - <<'PY' >/dev/null 2>&1
import socket
s = socket.socket()
s.settimeout(0.3)
try:
    s.connect(("127.0.0.1", 18445))
    raise SystemExit(0)
except Exception:
    raise SystemExit(1)
finally:
    s.close()
PY
    }
    for _ in $(seq 1 40); do
      if helper_ok; then
        exit 0
      fi
      sleep 0.15
    done
    if [[ -x /usr/bin/python3 && -f /opt/metavpn/bin/metavpn_xray_helper.py ]]; then
      mkdir -p /var/lib/metavpn
      nohup /usr/bin/python3 /opt/metavpn/bin/metavpn_xray_helper.py \
        >>/var/lib/metavpn/helper.log 2>&1 &
      for _ in $(seq 1 30); do
        if helper_ok; then
          exit 0
        fi
        sleep 0.15
      done
    fi
    if command -v systemctl >/dev/null 2>&1; then
      systemctl status metavpn-xray-helper.service --no-pager -l | head -40 >&2 || true
    fi
    echo "helper not listening on 18445" >&2
    exit 1
    ;;
  stop)
    if command -v systemctl >/dev/null 2>&1; then
      systemctl stop metavpn-xray-helper.service 2>/dev/null || true
    fi
    pkill -9 -f '/opt/metavpn/bin/xray' 2>/dev/null || true
    pkill -9 -f 'metavpn-xray-config' 2>/dev/null || true
    exit 0
    ;;
  status)
    if command -v systemctl >/dev/null 2>&1; then
      systemctl is-active metavpn-xray-helper.service
    else
      echo inactive
      exit 1
    fi
    ;;
  update)
    DEB="/tmp/metavpn-update.deb"
    if [[ ! -f "$DEB" ]]; then
      echo "update package missing" >&2
      exit 1
    fi
    PKG="$(dpkg-deb -f "$DEB" Package 2>/dev/null || true)"
    if [[ "$PKG" != "metavpn" ]]; then
      echo "refusing non-metavpn package" >&2
      exit 1
    fi
    export DEBIAN_FRONTEND=noninteractive
    apt-get install --reinstall -y "$DEB"
    ;;
  *)
    echo "usage: metavpn-ctl {ensure|restart|stop|status|update}" >&2
    exit 2
    ;;
esac
