#!/usr/bin/env bash

set -euo pipefail

HOST_UID=${HOST_UID:-0}
HOST_GID=${HOST_GID:-0}
DEFAULT_UID=${DEFAULT_UID:-1000}
DEFAULT_GID=${DEFAULT_GID:-1000}

ASSISTANT_USER=${ASSISTANT_USER:-assistant}
ASSISTANT_GROUP=${ASSISTANT_GROUP:-claude}
ASSISTANT_HOME=${ASSISTANT_HOME:-/home/${ASSISTANT_USER}}

if [ "$HOST_UID" -eq 0 ] && [ "$HOST_GID" -eq 0 ]; then
  HOST_UID=$DEFAULT_UID
  HOST_GID=$DEFAULT_GID
fi

if getent group "$HOST_GID" >/dev/null 2>&1; then
  ASSISTANT_GROUP="$(getent group "$HOST_GID" | cut -d: -f1)"
else
  groupadd -g "$HOST_GID" "$ASSISTANT_GROUP"
fi

# Ensure home exists, but don't recreate it
if [ ! -d "$ASSISTANT_HOME" ]; then
  mkdir -p "$ASSISTANT_HOME"
  chown "$HOST_UID:$HOST_GID" "$ASSISTANT_HOME"
fi
chown -R "$HOST_UID:$HOST_GID" "$ASSISTANT_HOME"

if id -u "$ASSISTANT_USER" >/dev/null 2>&1; then
  # Do NOT change -d (home) for existing user
  usermod -u "$HOST_UID" -g "$ASSISTANT_GROUP" "$ASSISTANT_USER"
else
  # Only use -m when home doesn't already exist
  useradd -u "$HOST_UID" -g "$ASSISTANT_GROUP" -d "$ASSISTANT_HOME" -s /bin/bash "$ASSISTANT_USER"
fi

# Grant passwordless sudo to claude user
echo "$ASSISTANT_USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/assistant
chmod 440 /etc/sudoers.d/assistant

install -d -m 0755 -o "$HOST_UID" -g "$HOST_GID" "$ASSISTANT_HOME/.local"
install -d -m 0755 -o "$HOST_UID" -g "$HOST_GID" "$ASSISTANT_HOME/.local/bin"
install -d -m 0755 -o "$HOST_UID" -g "$HOST_GID" "$ASSISTANT_HOME/.config"
install -d -m 0755 -o "$HOST_UID" -g "$HOST_GID" "$ASSISTANT_HOME/.claude"
install -d -m 0755 -o "$HOST_UID" -g "$HOST_GID" "$ASSISTANT_HOME/.abra"

# Copy Claude binaries to user's local bin (always, to ensure upgrades apply)
cp -r /root/.local/bin/* "$ASSISTANT_HOME/.local/bin/" 2>/dev/null || true
chown -R "$HOST_UID:$HOST_GID" "$ASSISTANT_HOME/.local/bin"

if [ -d /workspace ]; then
  chown -R "$HOST_UID:$HOST_GID" /workspace 2>/dev/null || true
fi
if [ -d /workspace/target ]; then
  chown -R "$HOST_UID:$HOST_GID" /workspace/target 2>/dev/null || true
fi

# Set up PATH in user's bashrc to avoid "~/.local/bin not in PATH" warning
if ! grep -q 'export PATH="\$HOME/.local/bin:\$PATH"' "$ASSISTANT_HOME/.bashrc" 2>/dev/null; then
  echo 'export PATH="$HOME/.local/bin:$PATH"' >> "$ASSISTANT_HOME/.bashrc"
  chown "$HOST_UID:$HOST_GID" "$ASSISTANT_HOME/.bashrc"
fi

export PATH="$ASSISTANT_HOME/.local/bin:$ASSISTANT_HOME/.cargo/bin:/usr/local/bin:$PATH"

if [ $# -gt 0 ]; then
  exec gosu "$ASSISTANT_USER" "$@"
else
  exec gosu "$ASSISTANT_USER" "$ASSISTANT_HOME/.local/bin/assistant" --dangerously-skip-permissions
fi