#!/usr/bin/env bash
set -euo pipefail

LAB_ROOT="${SORIA_LINUX_PERM_LAB:-/tmp/soria-linux-permissions-${USER:-$(id -un)}}"
MARKER="$LAB_ROOT/.soria-linux-permissions-lab"

usage() { echo 'Usage: module2-permissions-streams-lab.sh {setup|status|reset}'; }

is_safe_root() {
  case "$LAB_ROOT" in
    /tmp/soria-linux-permissions-*|"$HOME"/soria-linux-permissions-*) return 0 ;;
    *) return 1 ;;
  esac
}

require_safe_root() {
  is_safe_root || { printf 'Refusing unsafe lab path: %s\n' "$LAB_ROOT" >&2; exit 2; }
}

setup_lab() {
  require_safe_root
  if [[ -e "$LAB_ROOT" && ! -f "$MARKER" ]]; then
    printf 'Refusing existing unmarked directory: %s\n' "$LAB_ROOT" >&2
    exit 2
  fi

  mkdir -p "$LAB_ROOT"/{documents,partage,prive,bin,logs,sticky}
  : > "$MARKER"
  printf 'rapport public\n' > "$LAB_ROOT/documents/rapport.txt"
  printf 'secret interne\n' > "$LAB_ROOT/prive/secret.txt"
  printf 'donnee partagee\n' > "$LAB_ROOT/partage/equipe.txt"

  cat > "$LAB_ROOT/bin/diagnostic.sh" <<'EOF'
#!/usr/bin/env bash
printf 'service=web state=ok\n'
printf 'warning: cache almost full\n' >&2
exit 0
EOF

  cat > "$LAB_ROOT/bin/echec.sh" <<'EOF'
#!/usr/bin/env bash
printf 'starting check\n'
printf 'fatal: configuration missing\n' >&2
exit 42
EOF

  chmod 0644 "$LAB_ROOT/documents/rapport.txt"
  chmod 0600 "$LAB_ROOT/prive/secret.txt"
  chmod 0640 "$LAB_ROOT/partage/equipe.txt"
  chmod 0644 "$LAB_ROOT/bin/diagnostic.sh"
  chmod 0755 "$LAB_ROOT/bin/echec.sh"
  chmod 0750 "$LAB_ROOT/prive"
  chmod 0770 "$LAB_ROOT/partage"
  chmod 1777 "$LAB_ROOT/sticky"

  printf 'Lab ready: %s\n' "$LAB_ROOT"
}

show_status() {
  require_safe_root
  [[ -f "$MARKER" ]] || { printf 'Lab not initialized: %s\n' "$LAB_ROOT" >&2; exit 1; }

  find "$LAB_ROOT" -maxdepth 2 -mindepth 1 -printf '%M %u:%g %p\n' | sort
  stat -c '%a %A %U:%G %n' \
    "$LAB_ROOT/documents/rapport.txt" \
    "$LAB_ROOT/prive/secret.txt" \
    "$LAB_ROOT/partage/equipe.txt" \
    "$LAB_ROOT/bin/diagnostic.sh" \
    "$LAB_ROOT/sticky"

  if command -v getfacl >/dev/null 2>&1; then
    getfacl -p "$LAB_ROOT/partage/equipe.txt"
  else
    printf 'getfacl unavailable; install the acl package for the ACL exercise.\n'
  fi
}

reset_lab() {
  require_safe_root
  [[ -f "$MARKER" ]] || { printf 'Refusing reset without marker: %s\n' "$LAB_ROOT" >&2; exit 2; }
  rm -rf --one-file-system "$LAB_ROOT"
  printf 'Lab removed: %s\n' "$LAB_ROOT"
}

case "${1:-}" in
  setup) setup_lab ;;
  status) show_status ;;
  reset) reset_lab ;;
  *) usage; exit 2 ;;
esac