#!/usr/bin/env bash
set -euo pipefail

export DEBIAN_FRONTEND="${DEBIAN_FRONTEND:-noninteractive}"
APT_OPTS='-y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold'

# -------- Settings --------
ECZ_USER="${ECZ_USER:-ecz-gebruiker}"
WZ_NAME="ecz-watchhouse-workdir"
WORKDIR_URL="${WORKDIR_URL:-https://repo.easycomp.cloud/public_access/ECZ-BirdNET-Pi-WatchHouse/ecz-watchhouse-workdir.zip}"
BIRDN_INSTALL_URL="https://raw.githubusercontent.com/Nachtzuster/BirdNET-Pi/main/newinstaller.sh"
WIFI_COUNTRY="${WIFI_COUNTRY:-}"   # e.g. NL/BE/DE/GB

NM_CONN_ID="ECZ-BIRDNET-PI-SETUP"
NM_CONN_DST="/etc/NetworkManager/system-connections/${NM_CONN_ID}.nmconnection"
CADDYFILE="/etc/caddy/Caddyfile"

log(){ echo -e "\n\033[1;34m[+] $*\033[0m"; }
warn(){ echo -e "\n\033[1;33m[!] $*\033[0m"; }
die(){ echo -e "\n\033[1;31m[✗] $*\033[0m"; exit 1; }
require_root(){ [[ $EUID -eq 0 ]] || die "Run dit script met sudo of als root."; }

preflight_apt(){
  log "Preflight: clean APT/dpkg and avoid prompts…"
  killall -q whiptail dialog || true
  dpkg --configure -a || true
  apt-get ${APT_OPTS} -f install || true
}

ensure_user(){
  if ! id -u "$ECZ_USER" >/dev/null 2>&1; then
    log "Maak user ${ECZ_USER}…"
    adduser --disabled-password --gecos "" "$ECZ_USER"
    usermod -aG sudo,audio,video,plugdev,netdev "$ECZ_USER"
  else
    log "User ${ECZ_USER} bestaat al — oké."
  fi
}

fix_wifi_country(){
  if rfkill list 2>/dev/null | grep -qi 'Wireless LAN.*Soft blocked: yes'; then
    log "Wi‑Fi is geblokkeerd — rfkill unblock…"
    rfkill unblock wifi || true
  fi
  if [[ -n "${WIFI_COUNTRY}" ]] && command -v raspi-config >/dev/null 2>&1; then
    log "Wi‑Fi landcode instellen: ${WIFI_COUNTRY}"
    raspi-config nonint do_wifi_country "${WIFI_COUNTRY}" || true
    iw reg set "${WIFI_COUNTRY}" || true
  fi
}

install_prereqs(){
  log "Base packages installeren…"
  apt-get update
  apt-get ${APT_OPTS} install \
    curl ca-certificates network-manager caddy python3 python3-pip \
    rsync unzip
}

# fase‑1 (BirdNET-Pi) hoort al gedaan te zijn + reboot
# Dit script doet fase‑2.
stage_pkg(){
  STAGE_DIR="$(mktemp -d "/tmp/${WZ_NAME}-stage.XXXXXXXX")"
  STAGE_DIR="${STAGE_DIR//$'\r'/}"; STAGE_DIR="${STAGE_DIR//\\n/}"
  log "Stage pakket → ${STAGE_DIR}"

  curl -fL "$WORKDIR_URL" -o "$STAGE_DIR/payload.zip"
  unzip -q "$STAGE_DIR/payload.zip" -d "$STAGE_DIR/unpacked"

  # wizard root bepalen
  if [[ -d "$STAGE_DIR/unpacked/wizard" ]]; then
    PKG_ROOT="$STAGE_DIR/unpacked"
  else
    PKG_ROOT="$(find "$STAGE_DIR/unpacked" -maxdepth 2 -type d -name wizard -printf '%h\n' -quit || true)"
  fi
  if [[ -z "${PKG_ROOT:-}" ]]; then
    PKG_ROOT="$(dirname "$(find "$STAGE_DIR/unpacked" -maxdepth 3 -type f -name app.py -print -quit || true)")"
  fi
  [[ -n "${PKG_ROOT:-}" ]] || die "Wizard-bron niet gevonden (app.py)."
  WIZARD_SRC="$PKG_ROOT/wizard"; [[ -d "$WIZARD_SRC" ]] || WIZARD_SRC="$PKG_ROOT"

  # optioneel nmconnection in zip
  NM_FILE_FOUND="$(find "$STAGE_DIR/unpacked" -maxdepth 4 -type f -name '*.nmconnection' -print -quit || true)"

  export STAGE_DIR WIZARD_SRC NM_FILE_FOUND
  log "Wizard bron: $WIZARD_SRC"
  if [[ -n "$NM_FILE_FOUND" ]]; then
    log "NM-profiel in zip: $NM_FILE_FOUND"
  else
    warn "Geen .nmconnection in zip gevonden — we maken er één met nmcli."
  fi
}

deploy_wizard(){
  local WIZ_DIR="/home/${ECZ_USER}/birdnet-wifi-setup"
  log "Deploy wizard → ${WIZ_DIR}"
  mkdir -p "$WIZ_DIR"
  rsync -a "${WIZARD_SRC}/" "$WIZ_DIR/"
  chown -R "$ECZ_USER:$ECZ_USER" "$WIZ_DIR"

  # path fixes
  sed -i "s#/home/shaady/BirdNET-Pi/birdnet.conf#/home/${ECZ_USER}/BirdNET-Pi/birdnet.conf#g" "$WIZ_DIR/app.py" || true
  sed -i "s#/home/shaady#/home/${ECZ_USER}#g" "$WIZ_DIR/app.py" || true

  log "Python dependencies (Flask)…"
  if ! pip3 install --break-system-packages Flask==3.0.3 Jinja2 itsdangerous Werkzeug; then
    pip3 install Flask==3.0.3 Jinja2 itsdangerous Werkzeug
  fi
}

ensure_wlan0(){
  if ! ip link show wlan0 >/dev/null 2>&1; then
    die "Geen wlan0 interface gevonden. Controleer Wi‑Fi hardware/driver."
  fi
  nmcli r wifi on || true
  ip link set wlan0 up || true
}

install_or_create_hotspot(){
  log "Hotspotprofiel installeren/aanmaken…"
  mkdir -p "$(dirname "$NM_CONN_DST")"

  if [[ -n "${NM_FILE_FOUND:-}" && -f "$NM_FILE_FOUND" ]]; then
    install -m 0600 -o root -g root "$NM_FILE_FOUND" "$NM_CONN_DST"
    nmcli connection load "$NM_CONN_DST" >/dev/null || true
  else
    nmcli con delete "${NM_CONN_ID}" 2>/dev/null || true
    nmcli con add type wifi ifname wlan0 con-name "${NM_CONN_ID}" ssid "${NM_CONN_ID}"
    nmcli con modify "${NM_CONN_ID}" 802-11-wireless.mode ap
    nmcli con modify "${NM_CONN_ID}" 802-11-wireless.band bg
    nmcli con modify "${NM_CONN_ID}" 802-11-wireless.channel 6
    nmcli con modify "${NM_CONN_ID}" ipv4.method shared
    nmcli con modify "${NM_CONN_ID}" ipv6.method ignore
  fi

  systemctl restart NetworkManager
  sleep 2
  nmcli dev set wlan0 managed yes 2>/dev/null || true
  ip link set wlan0 up 2>/dev/null || true
  nmcli con down "client-wifi-setup" 2>/dev/null || true

  log "Activeer hotspot: ${NM_CONN_ID}"
  nmcli con up "${NM_CONN_ID}" ifname wlan0 || warn "Kon ${NM_CONN_ID} niet direct activeren."

  IP="$(ip -4 addr show wlan0 | awk '/inet /{print $2}' | cut -d/ -f1 || true)"
  log "wlan0 IP: ${IP:-geen} (verwacht: 10.42.0.1 of 10.42.x.x)"
}

enable_captive(){
  log "Caddy captive redirect in bestaand :80-blok injecteren…"

  [[ -f "$CADDYFILE" ]] || die "Caddyfile niet gevonden op $CADDYFILE — BirdNET‑Pi webserver lijkt niet geïnstalleerd."
  sudo cp -a "$CADDYFILE" "${CADDYFILE}.bak.$(date +%s)"

  # Al aanwezig? (marker check)
  if grep -q "ECZ captive probes" "$CADDYFILE"; then
    log "Captive rules bestaan al — overslaan."
    sudo caddy validate --config "$CADDYFILE" && { sudo systemctl reload caddy || sudo systemctl restart caddy; }
    return 0
  fi

  # Tel :80-blokken
  local count80
  count80="$(grep -cE '^[[:space:]]*:80[[:space:]]*\{' "$CADDYFILE" || true)"
  if [[ "${count80:-0}" -eq 0 ]]; then
    warn "Geen :80-blok gevonden — voeg minimalistisch :80-blok toe zonder BirdNET‑Pi te wijzigen."
    cat <<'EOF' | sudo tee -a "$CADDYFILE" >/dev/null

# --- Added by ECZ (no existing :80 block found) ---
:80 {
  # ECZ captive probes → wizard
  @captive path /generate_204 /hotspot-detect.html /connecttest.txt
  handle @captive {
    redir http://10.42.0.1:1234 302
  }
}
EOF
  else
    if [[ "$count80" -gt 1 ]]; then
      warn "Meerdere :80-blokken gedetecteerd — injecteer in het eerste blok en ga door."
    fi

    # Injecteer vóór de eerste afsluitende } van het EERSTE :80-blok
    sudo awk '
      BEGIN{in80=0; inserted=0}
      /^\s*:80\s*\{/ { if (!inserted) in80=1 }
      {
        print
        if (in80 && /^\}/ && !inserted) {
          print "  # ECZ captive probes → wizard"
          print "  @captive path /generate_204 /hotspot-detect.html /connecttest.txt"
          print "  handle @captive {"
          print "    redir http://10.42.0.1:1234 302"
          print "  }"
          inserted=1
          in80=0
        }
      }
    ' "$CADDYFILE" | sudo tee "${CADDYFILE}.new" >/dev/null
    sudo mv "${CADDYFILE}.new" "$CADDYFILE"
  fi

  # Valideer en reload; rollback bij fout
  if ! sudo caddy validate --config "$CADDYFILE"; then
    warn "Caddyfile validatie faalde — rollback naar backup."
    sudo mv "${CADDYFILE}.bak."* "$CADDYFILE" 2>/dev/null || true
    sudo caddy validate --config "$CADDYFILE" || die "Rollback mislukt, controleer Caddyfile handmatig."
  fi
  sudo systemctl reload caddy || sudo systemctl restart caddy
}

main(){
  require_root
  preflight_apt
  ensure_user
  fix_wifi_country
  install_prereqs

  log "=== Fase 2: wizard + hotspot + captive ==="
  stage_pkg
  deploy_wizard
  ensure_wlan0
  install_or_create_hotspot
  enable_captive

  log "Status:"
  nmcli -t -f DEVICE,TYPE,STATE,CONNECTION device status || true
  echo "wlan0 IP: $(ip -4 addr show wlan0 | awk '/inet /{print $2}' | cut -d/ -f1 || true)"
  systemctl --no-pager --full status ecz-setup-wizard | sed -n '1,12p' || true

  echo
  echo "✅ Klaar."
  echo "SSID: ${NM_CONN_ID} (open)  → captive of handmatig:  http://10.42.0.1:1234"
  echo "BirdNET‑Pi blijft op poort 80; wizard popup via captive probes."
}
main "$@"