#!/bin/bash
# Mac mini dev server setup — creates 'claude' user with SSH-key access from claude-server.
# Idempotent: safe to re-run.
#
# Usage:
#   curl -sL https://downloads.domian.network/mac-mini-dev.sh | sudo bash
#
# What this does:
#   1. Creates user 'claude' (admin group, UID 503, NOPASSWD sudo, no password)
#   2. Installs claude-server's ed25519 public key in /Users/claude/.ssh/authorized_keys
#   3. Enables Remote Login (SSH) if not already on
#   4. Sets ComputerName to "mac-mini-dev"
#
# Rollback:
#   sudo rm /etc/sudoers.d/claude && sudo sysadminctl -deleteUser claude -secure

set -euo pipefail

CLAUDE_USER="claude"
CLAUDE_UID="503"
CLAUDE_PUBKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDEIBFdSCeoPalMCc3e2QYammP6JR7HgB9gkJFlGBoi2 turing-pi-cluster-key-v2"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: must run as root (use sudo)." >&2
  exit 1
fi

echo "==> Mac mini dev server setup"
echo "    Hostname:    $(hostname)"
echo "    macOS:       $(sw_vers -productVersion)"
echo "    Hardware:    $(sysctl -n hw.model)"
echo ""

# 1) Create claude user (skip if exists)
if id "$CLAUDE_USER" >/dev/null 2>&1; then
  echo "==> User '$CLAUDE_USER' already exists — skipping creation"
else
  echo "==> Creating user '$CLAUDE_USER' (UID=$CLAUDE_UID, admin group)"
  sysadminctl -addUser "$CLAUDE_USER" \
    -UID "$CLAUDE_UID" \
    -fullName "Claude Server" \
    -home "/Users/$CLAUDE_USER" \
    -shell /bin/bash \
    -admin
  # Strip password (SSH key only)
  dscl . -delete "/Users/$CLAUDE_USER" AuthenticationAuthority 2>/dev/null || true
  dscl . -delete "/Users/$CLAUDE_USER" Password 2>/dev/null || true
  dscl . -create "/Users/$CLAUDE_USER" Password "*"
fi

# 2) Passwordless sudo
echo "==> Adding NOPASSWD sudo for '$CLAUDE_USER'"
cat > /etc/sudoers.d/claude <<EOF
$CLAUDE_USER ALL=(ALL) NOPASSWD:ALL
EOF
chmod 440 /etc/sudoers.d/claude
visudo -c -f /etc/sudoers.d/claude >/dev/null

# 3) SSH key
echo "==> Installing SSH public key"
SSH_DIR="/Users/$CLAUDE_USER/.ssh"
mkdir -p "$SSH_DIR"
touch "$SSH_DIR/authorized_keys"
# idempotent append — only add if key not already there
grep -qxF "$CLAUDE_PUBKEY" "$SSH_DIR/authorized_keys" || echo "$CLAUDE_PUBKEY" >> "$SSH_DIR/authorized_keys"
chown -R "$CLAUDE_USER":staff "$SSH_DIR"
chmod 700 "$SSH_DIR"
chmod 600 "$SSH_DIR/authorized_keys"

# 4) Enable Remote Login (SSH)
if systemsetup -getremotelogin 2>/dev/null | grep -qi "on"; then
  echo "==> Remote Login already enabled"
else
  echo "==> Enabling Remote Login"
  # systemsetup -setremotelogin requires Full Disk Access; prefer launchctl method
  launchctl enable system/com.openssh.sshd 2>/dev/null || true
  launchctl load -w /System/Library/LaunchDaemons/ssh.plist 2>/dev/null || true
  # Fallback: try systemsetup (may fail on FDA — print instructions)
  if ! systemsetup -setremotelogin on 2>/dev/null; then
    echo "    NOTE: systemsetup needs Full Disk Access."
    echo "    If SSH still isn't reachable, toggle manually:"
    echo "    System Settings → General → Sharing → Remote Login ON"
  fi
fi

# 5) Allow claude user for SSH
# macOS has access groups — add claude to com.apple.access_ssh group
dseditgroup -o edit -a "$CLAUDE_USER" -t user com.apple.access_ssh 2>/dev/null || true

# 6) Rename machine for clarity
CURRENT_NAME=$(scutil --get ComputerName 2>/dev/null || echo "")
if [[ "$CURRENT_NAME" != "mac-mini-dev" ]]; then
  echo "==> Setting ComputerName to 'mac-mini-dev' (was: '$CURRENT_NAME')"
  scutil --set ComputerName "mac-mini-dev"
  scutil --set HostName "mac-mini-dev"
  scutil --set LocalHostName "mac-mini-dev"
fi

echo ""
echo "==> Done."
echo ""
echo "From claude-server (10.0.0.99), test with:"
echo "    ssh claude@10.0.0.148 'whoami && hostname && sw_vers -productVersion'"
echo ""
echo "If SSH times out, flip Sharing → Remote Login ON manually in System Settings."