#!/usr/bin/env bash
set -euo pipefail

BREV_EMAIL="steineggerlab@gmail.com"
BREV_ORG="steineggerlab-spark"
MACHINE_NAME="$(hostname -s)"
ADMIN_USER="${SUDO_USER:-}"
USERS=(user1 user2 user3)
INSTALL_URL="https://raw.githubusercontent.com/brevdev/brev-cli/main/bin/install-latest.sh"

[[ $EUID -eq 0 ]] || {
  echo "Run with sudo."
  exit 1
}

[[ -n "$ADMIN_USER" && "$ADMIN_USER" != root ]] || {
  echo "Run with sudo from the Spark administrator account."
  exit 1
}

[[ "$MACHINE_NAME" =~ ^spark[0-9]{3}$ ]] || {
  echo "Hostname must use the format spark001, spark002, ..."
  exit 1
}

groupadd -f docker

for user in "${USERS[@]}"; do
  if ! id "$user" >/dev/null 2>&1; then
    useradd --create-home --shell /bin/bash "$user"
    passwd --lock "$user"
  fi

  usermod -aG docker "$user"

  echo "Installing Brev for $user..."
  runuser -u "$user" -- env HOME="/home/$user" \
    bash -c "curl -fsSL '$INSTALL_URL' | bash"

  if ! grep -qF '.local/bin' "/home/$user/.profile" 2>/dev/null; then
    echo 'export PATH="$HOME/.local/bin:$PATH"' >>"/home/$user/.profile"
    chown "$user:$(id -gn "$user")" "/home/$user/.profile"
  fi
done

ADMIN_HOME="$(getent passwd "$ADMIN_USER" | cut -d: -f6)"

echo "Installing Brev for administrator $ADMIN_USER..."
runuser -u "$ADMIN_USER" -- env HOME="$ADMIN_HOME" \
  bash -c "curl -fsSL '$INSTALL_URL' | bash"

echo
echo "Authenticate $BREV_EMAIL to register $MACHINE_NAME."
runuser -u "$ADMIN_USER" -- env HOME="$ADMIN_HOME" \
  "$ADMIN_HOME/.local/bin/brev" login \
    --email "$BREV_EMAIL" --skip-browser </dev/tty


runuser -u "$ADMIN_USER" -- env HOME="$ADMIN_HOME" \
  "$ADMIN_HOME/.local/bin/brev" org set "$BREV_ORG"

if [[ ! -f /etc/brev/device_registration.json ]]; then
  runuser -u "$ADMIN_USER" -- env HOME="$ADMIN_HOME" \
    "$ADMIN_HOME/.local/bin/brev" register \
      --name "$MACHINE_NAME" \
      --org "$BREV_ORG" </dev/tty
else
  echo "Spark is already registered."
fi

runuser -u "$ADMIN_USER" -- env HOME="$ADMIN_HOME" \
  "$ADMIN_HOME/.local/bin/brev" enable-ssh

for user in "${USERS[@]}"; do
  echo
  echo "Authenticate $BREV_EMAIL for $user."

  runuser -u "$user" -- env HOME="/home/$user" \
    "/home/$user/.local/bin/brev" login \
      --email "$BREV_EMAIL" --skip-browser </dev/tty

  runuser -u "$user" -- env HOME="/home/$user" \
    "/home/$user/.local/bin/brev" org set "$BREV_ORG"

#   echo "Enabling Brev SSH for $user..."
#     runuser -u "$user" -- env HOME="/home/$user" \
#       "/home/$user/.local/bin/brev" enable-ssh --user "$user"
done

echo
echo "Setup complete for $MACHINE_NAME in $BREV_ORG."
echo "Users must log out and back in before Docker access takes effect."