#!/usr/bin/with-contenv bashio
# shellcheck shell=bash
set -e
set -o pipefail

declare port=7681
declare username
declare password=""
declare workspace
declare canonical_workspace

export PATH="${HOME:-/data/data}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"

if bashio::config.has_value 'enable_terminal' && ! bashio::config.true 'enable_terminal'; then
    bashio::log.info "svc-claude-terminal: terminal disabled; idling"
    exec sleep infinity
fi

if [ -z "${HOME:-}" ]; then
    bashio::log.error "svc-claude-terminal: HOME is not initialized; idling"
    exec sleep infinity
fi

if ! command -v ttyd >/dev/null 2>&1 || ! command -v tmux >/dev/null 2>&1 || ! command -v claude >/dev/null 2>&1; then
    bashio::log.error "svc-claude-terminal: ttyd, tmux, or Claude Code is missing; idling"
    exec sleep infinity
fi

username="claude"
if bashio::config.has_value 'terminal_username'; then
    username="$(bashio::config 'terminal_username')"
fi

if bashio::config.has_value 'terminal_password'; then
    password="$(bashio::config 'terminal_password')"
elif bashio::config.has_value 'PASSWORD'; then
    bashio::log.warning "svc-claude-terminal: using PASSWORD as fallback for terminal authentication; prefer a unique terminal_password"
    password="$(bashio::config 'PASSWORD')"
fi

if [ -z "$password" ]; then
    bashio::log.warning "svc-claude-terminal: set terminal_password (or PASSWORD) before mapping port ${port}; terminal will remain disabled"
    exec sleep infinity
fi

workspace="${HOME}/workspace"
if bashio::config.has_value 'terminal_workspace'; then
    workspace="$(bashio::config 'terminal_workspace')"
fi

if [[ "$workspace" != /* ]]; then
    bashio::log.error "svc-claude-terminal: terminal_workspace must be an absolute path; idling"
    exec sleep infinity
fi

if [ -L "$workspace" ]; then
    bashio::log.error "svc-claude-terminal: terminal_workspace must not be a symbolic link; idling"
    exec sleep infinity
fi

if ! canonical_workspace="$(realpath -m -- "$workspace")"; then
    bashio::log.error "svc-claude-terminal: unable to resolve terminal_workspace '$workspace'; idling"
    exec sleep infinity
fi
workspace="$canonical_workspace"

case "$workspace" in
    "$HOME" | "$HOME"/* | /share/* | /media/* | /mnt/* | /data/* | /config/*)
        ;;
    *)
        bashio::log.error "svc-claude-terminal: terminal_workspace must be the configured data_location or a subdirectory of /share, /media, /mnt, /data, or /config; idling"
        exec sleep infinity
        ;;
esac

if [ ! -e "$workspace" ]; then
    if ! install -d -m 0750 -o abc -g abc -- "$workspace"; then
        bashio::log.error "svc-claude-terminal: failed to create workspace '$workspace'; idling"
        exec sleep infinity
    fi
elif [ ! -d "$workspace" ]; then
    bashio::log.error "svc-claude-terminal: terminal_workspace '$workspace' is not a directory; idling"
    exec sleep infinity
fi

if ! s6-setuidgid abc test -r "$workspace" ||
    ! s6-setuidgid abc test -w "$workspace" ||
    ! s6-setuidgid abc test -x "$workspace"; then
    bashio::log.error "svc-claude-terminal: workspace '$workspace' must be readable, writable, and searchable by user abc; idling"
    exec sleep infinity
fi

export CLAUDE_TERMINAL_WORKSPACE="$workspace"

bashio::log.info "svc-claude-terminal: starting authenticated ttyd terminal on port ${port}; workspace=${workspace}"
exec s6-setuidgid abc ttyd \
    -p "$port" \
    -W \
    -O \
    -c "${username}:${password}" \
    /usr/local/bin/claude-terminal-shell