#!/usr/bin/env bash
source $(dirname $0)/config.sh
set -euo pipefail

##parametri di config
MAX_RETRIES=10
RETRY_DELAY=5
UPLOAD_OK=0
PUBKEY_URL="https://bacheca.fulsvc.com/teleassistenza/pub_openvision.txt"
EXPECTED_FPR="1397686edb0d3910c65ae86f0b005f5a016d2b816ab19bbca58aa9f607e79eca"

##scarico chiave pubblica
TMP=$(mktemp -d); chmod 700 "$TMP"; trap 'rm -rf "$TMP"' EXIT

curl -fsS --proto '=https' --tlsv1.2 "$PUBKEY_URL" -o "$TMP/pub.pem"

FPR=$(openssl pkey -pubin -in "$TMP/pub.pem" -outform DER \
      | openssl dgst -sha256 -r | cut -d' ' -f1)
[[ "$FPR" == "$EXPECTED_FPR" ]] || { echo "Fingerprint chiave NON valido: $FPR" >&2; exit 1; }

##metodo helper
json_escape() {
    local s=$1
    s=${s//\\/\\\\}      # \ -> \\
    s=${s//\"/\\\"}      # " -> \"
    printf '%s' "$s"
}

IDUSER=$(grep '^iduser=' config.sh | cut -d'=' -f2)
echo "LAVORO PER $IDUSER"

echo "Rimuovo eventuale installazione già presente"
sudo apt purge -y anydesk || echo "AnyDesk non installato o purge fallito, continuo"

##scarico pacchetto anydesk
echo "Scarico pacchetto"
sudo apt-get install -y libegl1-mesa
wget https://download.anydesk.com/rpi/anydesk_6.3.0-1_armhf.deb


##installo pacchetto anydesk
echo "Installo pacchetto"
sudo dpkg -i anydesk_6.3.0-1_armhf.deb
sudo usermod -a -G video kiosk
##genero password random
PASSWORD=$(date +%s | sha256sum | base64 | head -c 15)


## || true significa che non è bloccante
DISPLAY=:0 xhost + || echo "WARN: xhost fallito, continuo comunque"

# Assicuro che il servizio AnyDesk sia partito
sudo systemctl restart anydesk

# Attendo che systemd veda il servizio attivo
for i in $(seq 1 "$MAX_RETRIES"); do
    if systemctl is-active --quiet anydesk; then
        echo "AnyDesk service attivo"
        break
    fi

    echo "AnyDesk non ancora attivo - tentativo $i/$MAX_RETRIES"

    if [ "$i" -eq "$MAX_RETRIES" ]; then
        echo "ERRORE: servizio AnyDesk non avviato"
        exit 1
    fi

    sleep "$RETRY_DELAY"
done

# Attendo che AnyDesk generi un ID valido
ANYDESK_ID=""

#OLD ANYDESK_ID=$(sudo anydesk --get-id)


for i in $(seq 1 "$MAX_RETRIES"); do
    echo "Recupero ID AnyDesk - tentativo $i/$MAX_RETRIES"

    ANYDESK_ID=$(timeout 10s sudo anydesk --get-id 2>/dev/null || true)
    ANYDESK_ID=$(printf '%s' "$ANYDESK_ID" | tr -d '\r\n')

    if [[ "$ANYDESK_ID" =~ ^[0-9]+$ ]] && [ "$ANYDESK_ID" != "0" ]; then
        echo "ID AnyDesk recuperato: $ANYDESK_ID"
        break
    fi

    ANYDESK_ID=""

    echo "WARN: ID AnyDesk non disponibile"

    if [ "$i" -lt "$MAX_RETRIES" ]; then
        sleep "$RETRY_DELAY"
    fi
done



if [ -z "$ANYDESK_ID" ] || [ "$ANYDESK_ID" = "0" ]; then
    echo "ERRORE: impossibile recuperare l'ID AnyDesk"
    exit 1
else
	cp config.sh "config-old-$(date '+%Y%m%d_%H%M%S').sh"
	if grep -q '^idanydesk=' config.sh; then
		sed -i "s/^idanydesk=.*/idanydesk=$ANYDESK_ID/" config.sh
	else
		echo "idanydesk=$ANYDESK_ID" >> config.sh
	fi
fi


#if echo "$PASSWORD" | sudo anydesk --set-password; then
#    echo "Password AnyDesk impostata correttamente"
#else
#    echo "ERRORE: impossibile impostare la password AnyDesk"
#    exit 1
#fi


PASSWORD_SET=0

for i in $(seq 1 "$MAX_RETRIES"); do
    echo "Impostazione password AnyDesk - tentativo $i/$MAX_RETRIES"

    if printf '%s\n' "$PASSWORD" | sudo anydesk --set-password; then
        echo "Password AnyDesk impostata correttamente"
        PASSWORD_SET=1
        break
    fi

    echo "WARN: impossibile impostare la password AnyDesk"

    if [ "$i" -lt "$MAX_RETRIES" ]; then
        sleep "$RETRY_DELAY"
    fi
done

if [ "$PASSWORD_SET" -ne 1 ]; then
    echo "ERRORE: impossibile impostare la password AnyDesk dopo $MAX_RETRIES tentativi"
    exit 1
fi





# timestamp + nonce dentro la busta cifrata: anti-replay
PLAIN=$(printf '{"ts":%s,"nonce":"%s","password":"%s"}' \
        "$(date +%s)" "$(openssl rand -hex 12)" "$(json_escape "$PASSWORD")")
unset PW

BLOB=$(printf '%s' "$PLAIN" | openssl pkeyutl -encrypt -pubin -inkey "$TMP/pub.pem" -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 | base64 -w0)
unset PLAIN


if [ -z "$BLOB" ] || [ "$BLOB" = "0" ]; then
    echo "ERRORE: impossibile recuperare la password"
    exit 1
else
	cp config.sh "config-old-$(date '+%Y%m%d_%H%M%S').sh"
	if grep -q '^passenc=' config.sh; then
        BLOB_ESCAPED=$(printf '%s' "$BLOB" | sed 's/[&|]/\\&/g')
        sed -i "s|^passenc=.*|passenc=$BLOB_ESCAPED|" config.sh
    else
        echo "passenc=$BLOB" >> config.sh
    fi
fi

echo "aggiungo controllo servizio Anydesk"
sudo mkdir -p /etc/systemd/system/anydesk.service.d
 
sudo tee /etc/systemd/system/anydesk.service.d/restart.conf >/dev/null <<'EOF'
[Service]
Restart=always
RestartSec=10
EOF
 
sudo systemctl daemon-reload
sudo systemctl enable anydesk
sudo systemctl restart anydesk
echo "terminato aggiunta controllo servizio Anydesk"

echo ""
echo "----------------------"
echo "idanydesk: $ANYDESK_ID"
echo "pass: $PASSWORD"
echo "----------------------"