#!/usr/bin/env bash
set -euo pipefail

SERVICE_DROPIN_DIR="/etc/systemd/system/model-gateway.service.d"
SERVICE_DROPIN="$SERVICE_DROPIN_DIR/run-user.conf"

usage() {
  cat <<'EOF'
Usage:
  sudo model-gateway-set-run-user USER
  sudo model-gateway-set-run-user --default

Run model-gateway as USER instead of the dedicated model-gateway service user.
This is useful on single-user machines when models are stored under that user's
home directory. The default dedicated service user is safer for shared systems.
EOF
}

if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
  echo "Please run as root: sudo model-gateway-set-run-user USER" >&2
  exit 1
fi

if [[ $# -ne 1 || "$1" == "-h" || "$1" == "--help" ]]; then
  usage
  exit $([[ $# -eq 1 && ( "$1" == "-h" || "$1" == "--help" ) ]] && echo 0 || echo 2)
fi

RUN_USER="$1"

ensure_service_user() {
  if ! getent group model-gateway >/dev/null 2>&1; then
    groupadd --system model-gateway
  fi
  if ! id model-gateway >/dev/null 2>&1; then
    useradd --system --home /var/lib/model-gateway --shell /usr/sbin/nologin --gid model-gateway model-gateway
  fi
}

prepare_writable_state() {
  local user_name="$1"
  local group_name="$2"
  install -d -m 0755 /var/lib/model-gateway /var/lib/model-gateway/models \
    /var/lib/model-gateway/data /var/lib/model-gateway/uploads /var/log/model-gateway
  chown -R "$user_name:$group_name" /var/lib/model-gateway /var/log/model-gateway
  install -d -m 3777 /var/lib/model-gateway/downloads
  chmod 3777 /var/lib/model-gateway/downloads
  if command -v setfacl >/dev/null 2>&1; then
    setfacl -m g:model-gateway:rwx /var/lib/model-gateway/downloads || true
    setfacl -d -m g:model-gateway:rwx /var/lib/model-gateway/downloads || true
  fi
}

if [[ "$RUN_USER" == "--default" || "$RUN_USER" == "model-gateway" ]]; then
  ensure_service_user
  rm -f "$SERVICE_DROPIN"
  prepare_writable_state model-gateway model-gateway
  ACTIVE_USER="model-gateway"
else
  if ! id "$RUN_USER" >/dev/null 2>&1; then
    echo "User not found: $RUN_USER" >&2
    exit 2
  fi
  ensure_service_user
  RUN_GROUP="$(id -gn "$RUN_USER")"
  usermod -a -G model-gateway "$RUN_USER" || true
  install -d -m 0755 "$SERVICE_DROPIN_DIR"
  cat > "$SERVICE_DROPIN" <<EOF
[Service]
User=$RUN_USER
Group=$RUN_GROUP
SupplementaryGroups=model-gateway
EOF
  prepare_writable_state "$RUN_USER" "$RUN_GROUP"
  ACTIVE_USER="$RUN_USER"
fi

systemctl daemon-reload
systemctl restart model-gateway

cat <<MSG
model-gateway is now configured to run as: $ACTIVE_USER

Check:
  systemctl show model-gateway -p User -p Group -p SupplementaryGroups
  systemctl status model-gateway --no-pager
MSG
