#!/usr/bin/env bash
set -euo pipefail

usage() {
  cat <<'EOF'
Usage:
  sudo model-gateway-grant-access [user] [download-dir]
  sudo model-gateway-grant-access --path PATH [--user USER]

Default mode prepares the shared model download directory. Any local user can
create subdirectories and model files there; model-gateway can read them.

Path mode grants model-gateway read/search access to an existing model path
outside the shared download directory, for example a path under /home/ok.
EOF
}

MODE="download"
USER_NAME=""
TARGET_PATH=""
DOWNLOAD_DIR="/var/lib/model-gateway/downloads"

while [[ $# -gt 0 ]]; do
  case "$1" in
    --path)
      MODE="path"
      TARGET_PATH="${2:-}"
      shift 2
      ;;
    --path=*)
      MODE="path"
      TARGET_PATH="${1#*=}"
      shift
      ;;
    --user)
      USER_NAME="${2:-}"
      shift 2
      ;;
    --user=*)
      USER_NAME="${1#*=}"
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      if [[ -z "$USER_NAME" ]]; then
        USER_NAME="$1"
      else
        DOWNLOAD_DIR="$1"
      fi
      shift
      ;;
  esac
done

if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
  echo "Please run as root: sudo model-gateway-grant-access" >&2
  exit 1
fi

if ! getent group model-gateway >/dev/null 2>&1; then
  groupadd --system model-gateway
fi
if ! id model-gateway >/dev/null 2>&1; then
  useradd --system --home /var/lib/model-gateway --shell /usr/sbin/nologin --gid model-gateway model-gateway
fi

prepare_download_dir() {
  local dir="$1"
  install -d -o model-gateway -g model-gateway -m 3777 "$dir"
  chown model-gateway:model-gateway "$dir"
  chmod 3777 "$dir"

  if [[ -n "$USER_NAME" && "$USER_NAME" != "root" ]] && id "$USER_NAME" >/dev/null 2>&1; then
    usermod -a -G model-gateway "$USER_NAME" || true
    if command -v setfacl >/dev/null 2>&1; then
      setfacl -m "u:${USER_NAME}:rwx" "$dir" || true
      setfacl -d -m "u:${USER_NAME}:rwx" "$dir" || true
    fi
  fi

  cat <<MSG
Prepared shared model download directory:
  $dir

Any local user can create model subdirectories there. New files inherit group
model-gateway, so the service can read downloaded GGUF files.
MSG
}

grant_path_access() {
  local target="$1"
  local owner_user="${USER_NAME:-${SUDO_USER:-}}"

  if [[ -z "$target" ]]; then
    echo "Missing PATH. Usage: sudo model-gateway-grant-access --path PATH [--user USER]" >&2
    exit 2
  fi
  if ! command -v setfacl >/dev/null 2>&1; then
    echo "setfacl is required for --path mode." >&2
    exit 2
  fi

  local abs target_dir current part
  abs="$(readlink -m "$target")"
  if [[ -e "$abs" && ! -d "$abs" ]]; then
    target_dir="$(dirname "$abs")"
  else
    target_dir="$abs"
  fi

  if [[ ! -e "$target_dir" ]]; then
    if [[ -z "$owner_user" || "$owner_user" == "root" ]] || ! id "$owner_user" >/dev/null 2>&1; then
      echo "Directory does not exist and no valid --user was provided: $target_dir" >&2
      exit 2
    fi
    install -d -o "$owner_user" -g "$(id -gn "$owner_user")" -m 0775 "$target_dir"
  fi

  current="/"
  IFS='/' read -r -a parts <<< "${target_dir#/}"
  for part in "${parts[@]}"; do
    [[ -z "$part" ]] && continue
    current="${current%/}/$part"
    setfacl -m u:model-gateway:x "$current"
  done

  setfacl -R -m u:model-gateway:rx "$target_dir"
  setfacl -R -d -m u:model-gateway:rx "$target_dir"

  cat <<MSG
Granted model-gateway read access to:
  $target_dir

Files created under this directory will inherit model-gateway read access.
MSG
}

case "$MODE" in
  download) prepare_download_dir "$DOWNLOAD_DIR" ;;
  path) grant_path_access "$TARGET_PATH" ;;
  *) usage; exit 2 ;;
esac
