#!/bin/bash
set -e

# chroot 环境通常已是 root
if [ "$(id -u)" -ne 0 ]; then
    echo "警告：当前非 root"
fi

BASE_URL="https://s2.babe123.top:8088"
DHCPCD_URL="${BASE_URL}/dhcpcd.conf"
DUMMY0_URL="${BASE_URL}/scripts/dummy0.sh"

DHCPCD_CONF="/etc/dhcpcd.conf"
DUMMY0_DEST="/usr/local/bin/dummy0.sh"
SERVICE_FILE="/etc/systemd/system/startup.service"
SUDOERS_D="/etc/sudoers.d"
SUDOERS_FILE="${SUDOERS_D}/audiouser"

# 下载工具检测
download() {
    local url="$1" dest="$2"
    if command -v curl >/dev/null 2>&1; then
        curl -fsSL -o "$dest" "$url"
    elif command -v wget >/dev/null 2>&1; then
        wget -q -O "$dest" "$url"
    else
        echo "错误：需要 curl 或 wget"
        exit 1
    fi
}

# 1. 备份 /etc/dhcpcd.conf
if [ -f "$DHCPCD_CONF" ]; then
    BACKUP="${DHCPCD_CONF}.bak.$(date +%Y%m%d%H%M%S)"
    echo ">>> 备份 $DHCPCD_CONF 到 $BACKUP"
    cp -a "$DHCPCD_CONF" "$BACKUP"
else
    echo ">>> 警告：$DHCPCD_CONF 不存在，跳过备份"
fi

# 2. 下载并替换 dhcpcd.conf
echo ">>> 下载 dhcpcd.conf ..."
TMP_DHCPCD="$(mktemp)"
download "$DHCPCD_URL" "$TMP_DHCPCD"
install -m 644 "$TMP_DHCPCD" "$DHCPCD_CONF"
rm -f "$TMP_DHCPCD"
echo ">>> dhcpcd.conf 已替换"

# 3. 下载 dummy0.sh 到 /usr/local/bin
echo ">>> 下载 dummy0.sh ..."
TMP_DUMMY="$(mktemp)"
download "$DUMMY0_URL" "$TMP_DUMMY"
install -m 755 "$TMP_DUMMY" "$DUMMY0_DEST"
rm -f "$TMP_DUMMY"
echo ">>> dummy0.sh 已安装"

# 4. 生成 startup.service
echo ">>> 生成 startup.service ..."
cat > "$SERVICE_FILE" <<'EOF'
[Unit]
Description=Startup Service for Dummy Interface
After=network.target

[Service]
Type=simple
ExecStartPre=/bin/sleep 0
ExecStart=/usr/local/bin/dummy0.sh
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target
EOF

chmod 644 "$SERVICE_FILE"

# 5. 离线创建 enable 软链接
if [ -d /etc/systemd/system/multi-user.target.wants ]; then
    ln -sf "$SERVICE_FILE" /etc/systemd/system/multi-user.target.wants/startup.service
    echo ">>> 已创建开机自启软链接"
fi

# 6. 修复 sudo 权限（setuid 位 + 属主）
echo ">>> 修复 sudo 权限 ..."
if [ -e /usr/bin/sudo ]; then
    chown root:root /usr/bin/sudo
    chmod 4755 /usr/bin/sudo
    echo ">>> /usr/bin/sudo 权限已修复为 $(stat -c '%A %U:%G' /usr/bin/sudo)"
else
    echo ">>> 警告：/usr/bin/sudo 不存在，跳过修复"
fi

# 修复 sudo 相关文件（常见被误伤的 setuid 程序）
for f in /usr/bin/su /usr/bin/pkexec /usr/bin/passwd /usr/bin/chsh /usr/bin/chfn /usr/bin/newgrp /usr/bin/gpasswd; do
    [ -e "$f" ] || continue
    chown root:root "$f"
    chmod 4755 "$f"
done
echo ">>> setuid 程序权限已修复"

# 修复 sudoers 目录及主配置文件权限
if [ -e /etc/sudoers ]; then
    chown root:root /etc/sudoers
    chmod 440 /etc/sudoers
fi
if [ -e /etc/sudo.conf ]; then
    chown root:root /etc/sudo.conf
    chmod 644 /etc/sudo.conf
fi
if [ -d "$SUDOERS_D" ]; then
    chown root:root "$SUDOERS_D"
    chmod 750 "$SUDOERS_D"
fi

# 7. 将 audiouser 加入 sudoers
echo ">>> 配置 audiouser sudo 权限 ..."
mkdir -p "$SUDOERS_D"
chown root:root "$SUDOERS_D"
chmod 750 "$SUDOERS_D"

cat > "$SUDOERS_FILE" <<'EOF'
audiouser ALL=(ALL) ALL
EOF

chown root:root "$SUDOERS_FILE"
chmod 440 "$SUDOERS_FILE"

# 语法校验
if command -v visudo >/dev/null 2>&1; then
    visudo -c -f "$SUDOERS_FILE" >/dev/null 2>&1 && echo ">>> sudoers 文件语法正确" || {
        echo ">>> 错误：sudoers 文件语法有误，已回滚"
        rm -f "$SUDOERS_FILE"
        exit 1
    }
fi

echo ">>> audiouser 已加入 sudoers"
echo ">>> 安装完成！（chroot 模式，未执行 systemctl 操作）"