#!/bin/bash
# Install workout locker as a systemd user service

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SERVICE_FILE="$SCRIPT_DIR/workout-locker.service"
EARLY_BIRD_TIMER_FILE="$SCRIPT_DIR/early-bird-workout-check.timer"
LOCKER_TIMER_FILE="$SCRIPT_DIR/workout-locker.timer"
SYNC_SERVICE_FILE="$SCRIPT_DIR/workout-sync.service"
SYNC_TIMER_FILE="$SCRIPT_DIR/workout-sync.timer"
USER_SERVICE_DIR="$HOME/.config/systemd/user"
SERVICE_NAME="workout-locker.service"
EARLY_BIRD_TIMER_NAME="early-bird-workout-check.timer"
LOCKER_TIMER_NAME="workout-locker.timer"
SYNC_SERVICE_NAME="workout-sync.service"
SYNC_TIMER_NAME="workout-sync.timer"
BONUS_SERVICE_NAME="earner-bonus.service"
BONUS_PATH_NAME="earner-bonus.path"
RUNNERUP_WATCH_NAME="runnerup-watch.service"
WORKOUT_POKE_NAME="workout-poke.service"

# Runtime dependencies. screen_lock.py imports tkinter at module scope. On Arch
# the tkinter MODULE ships inside the `python` package, but the shared library
# it dlopens does not: without `tk` the import dies with
# "ImportError: libtk8.6.so: cannot open shared object file" and this installer
# exits 1. That is exactly how a fresh Arch box behaves, since `tk` is only an
# optional dependency of python. Install it rather than documenting it: a fresh
# install must not require the user to know this.
ensure_runtime_deps() {
	if ! python3 -c 'import tkinter' 2>/dev/null; then
		if command -v pacman >/dev/null 2>&1; then
			echo "Installing missing system dependency: tk"
			if [ "$(id -u)" -eq 0 ]; then
				pacman -S --needed --noconfirm tk
			else
				sudo pacman -S --needed --noconfirm tk
			fi
		else
			echo "WARNING: tkinter missing and pacman unavailable - install tk manually" >&2
		fi
	fi

	# inotifywait drives runnerup-watch.service (instant RunnerUp credit).
	if ! command -v inotifywait >/dev/null 2>&1; then
		if command -v pacman >/dev/null 2>&1; then
			echo "Installing missing system dependency: inotify-tools"
			if [ "$(id -u)" -eq 0 ]; then
				pacman -S --needed --noconfirm inotify-tools
			else
				sudo pacman -S --needed --noconfirm inotify-tools
			fi
		else
			echo "WARNING: inotifywait missing and pacman unavailable - RunnerUp runs are credited only by the 15-min timer" >&2
		fi
	fi

	# The two shared RUNTIME dependencies, both pinned git deps in
	# pyproject.toml: gatelock (lock-window/HMAC backend) and crdt-sync (the
	# workout-sync transport). Nothing here used to install either, so a fresh
	# checkout died with "ModuleNotFoundError: No module named 'gatelock'" the
	# first time the post-install workout check ran, and with crdt_sync right
	# after that. requirements.txt is NOT used here on purpose: it also pins the
	# dev toolchain (pytest, mypy, ruff...), which a fresh install does not need.
	#
	# Arch marks its system Python externally-managed, so a plain `pip install`
	# refuses; --break-system-packages is what the sibling installers already use.
	_pip_runtime_dep() { # <import-name> <pip-spec>
		python3 -c "import $1" 2>/dev/null && return 0
		echo "Installing missing Python dependency: $1"
		pip3 install --user --quiet "$2" 2>/dev/null ||
			pip3 install --user --break-system-packages --quiet "$2" ||
			echo "WARNING: could not install $1 automatically" >&2
	}
	_pip_runtime_dep gatelock \
		"gatelock @ git+https://github.com/kuhyx/utils@gatelock-v0.9.0#subdirectory=gatelock"
	_pip_runtime_dep crdt_sync \
		"crdt-sync @ git+https://github.com/kuhyx/utils@crdt-sync-v0.9.0#subdirectory=crdt-sync"
}
ensure_runtime_deps

# shellcheck source=scripts/disarm_guard.sh
source "$SCRIPT_DIR/scripts/disarm_guard.sh"
# Installing units here would overwrite the systemd mask symlinks, so this
# path has to respect the disarm marker too. Re-arm via: ./arm.sh --rearm
refuse_if_disarmed

# Check if service is already installed
if [ -f "$USER_SERVICE_DIR/$SERVICE_NAME" ]; then
	echo "Screen locker systemd service is already installed."
	echo "Current status:"
	systemctl --user status "$SERVICE_NAME" --no-pager || true
	echo ""
	read -p "Do you want to reinstall/update it? (y/n) " -n 1 -r
	echo
	if [[ ! $REPLY =~ ^[Yy]$ ]]; then
		echo "Keeping existing installation"
		exit 0
	fi
fi

# Create user systemd directory if it doesn't exist
mkdir -p "$USER_SERVICE_DIR"

# Remove old timer if it was previously installed
if systemctl --user is-active "workout-locker.timer" &>/dev/null; then
	systemctl --user disable --now "workout-locker.timer" 2>/dev/null || true
fi
rm -f "$USER_SERVICE_DIR/workout-locker.timer"

# Seed shutdown_base.json if not already present. It holds only date stamps;
# the base hour itself comes from the earned_time registry (kuhyx/utils).
SHUTDOWN_BASE="$SCRIPT_DIR/screen_locker/shutdown_base.json"
if [[ ! -f "$SHUTDOWN_BASE" ]]; then
	printf '{\n  "last_reset_date": ""\n}\n' > "$SHUTDOWN_BASE"
	echo "✓ Created shutdown_base.json"
fi

# Copy service file to user systemd directory
cp "$SERVICE_FILE" "$USER_SERVICE_DIR/$SERVICE_NAME"

# Copy early bird timer
cp "$EARLY_BIRD_TIMER_FILE" "$USER_SERVICE_DIR/$EARLY_BIRD_TIMER_NAME"

# Copy the periodic re-check timer. Without it the locker only ever decides at
# login and at 08:30/09:05, so a day or ISO-week boundary crossed inside a long
# session is never re-evaluated.
cp "$LOCKER_TIMER_FILE" "$USER_SERVICE_DIR/$LOCKER_TIMER_NAME"

# Copy the periodic workout-sync units. Without these, syncing happens only
# once per locker start, so a workout finished after login is not seen until
# the next login.
cp "$SYNC_SERVICE_FILE" "$USER_SERVICE_DIR/$SYNC_SERVICE_NAME"
cp "$SYNC_TIMER_FILE" "$USER_SERVICE_DIR/$SYNC_TIMER_NAME"

# The ledger watch: a gate writing its ledger applies the earned shutdown
# bonus at once instead of at the next 15-minute sync. The .path unit is
# rendered from the earned_time registry, so it is generated, not copied.
cp "$SCRIPT_DIR/$BONUS_SERVICE_NAME" "$USER_SERVICE_DIR/$BONUS_SERVICE_NAME"
PYTHONPATH="$SCRIPT_DIR" python3 -m screen_locker._earner_units "$USER_SERVICE_DIR"

# The RunnerUp upload watch: a TCX landing in ~/data/cloud/RunnerUp starts
# workout-sync at once instead of waiting for the next timer tick.
cp "$SCRIPT_DIR/$RUNNERUP_WATCH_NAME" "$USER_SERVICE_DIR/$RUNNERUP_WATCH_NAME"

# The phone's LAN poke: a finished StrongLifts session is credited within a
# second instead of at the next sync. The key must exist before the unit
# starts, or it refuses to (docs/DOCS-workout-poke-contract.md).
bash "$SCRIPT_DIR/scripts/workout_poke_keygen.sh"
cp "$SCRIPT_DIR/$WORKOUT_POKE_NAME" "$USER_SERVICE_DIR/$WORKOUT_POKE_NAME"

# Update paths in the service file to use absolute paths
REPO_ROOT="$SCRIPT_DIR"
sed -i "s|WorkingDirectory=.*|WorkingDirectory=$REPO_ROOT|" "$USER_SERVICE_DIR/$SERVICE_NAME"
sed -i "s|Environment=PYTHONPATH=.*|Environment=PYTHONPATH=$REPO_ROOT|" "$USER_SERVICE_DIR/$SERVICE_NAME"
sed -i "s|ExecStart=/usr/bin/python3.*|ExecStart=/usr/bin/python3 -m screen_locker.screen_lock --production|" "$USER_SERVICE_DIR/$SERVICE_NAME"

# Reload systemd daemon
systemctl --user daemon-reload

# Enable the service to start on login (one-shot, no periodic timer)
systemctl --user enable "$SERVICE_NAME"

# Enable the early bird re-check timer
systemctl --user enable --now "$EARLY_BIRD_TIMER_NAME"

# Enable the periodic re-check timer
systemctl --user enable --now "$LOCKER_TIMER_NAME"

# Enable the periodic workout sync
systemctl --user enable --now "$SYNC_TIMER_NAME"

# Enable the instant bonus pass on ledger writes
systemctl --user enable --now "$BONUS_PATH_NAME"

# Enable the instant RunnerUp credit on upload (restart picks up a new script)
systemctl --user enable "$RUNNERUP_WATCH_NAME"
systemctl --user restart "$RUNNERUP_WATCH_NAME"

# Enable the LAN workout poke listener (restart picks up new code)
systemctl --user enable "$WORKOUT_POKE_NAME"
systemctl --user restart "$WORKOUT_POKE_NAME"

# Verify enforcement is actually armed. enable can silently no-op when systemd
# breaks an ordering cycle by deleting the timer's job -- exactly what happened
# on 2026-08-04 -- so a successful `enable` is NOT proof the locker will run.
if ! python3 "$SCRIPT_DIR/scripts/check_enforcement_armed.py"; then
	echo "✗ Enforcement is NOT armed after install — see the errors above" >&2
	exit 1
fi

echo "✓ Workout locker service installed"
echo "✓ Early bird re-check timer installed (fires daily at 08:30)"
echo "✓ Periodic re-check timer installed (every 30 min)"
echo "✓ Service will start automatically on next login"
echo ""
echo "To start now: systemctl --user start workout-locker"
echo "To check status: systemctl --user status workout-locker"
echo "To stop: systemctl --user stop workout-locker"
echo "To disable autostart: systemctl --user disable workout-locker"

# Check autostart installation status
echo ""
echo "=== Autostart Status ==="
if systemctl --user is-enabled "$SERVICE_NAME" &>/dev/null; then
	echo "✓ systemd service: INSTALLED and enabled"
else
	echo "✗ systemd service: NOT enabled"
fi
if systemctl --user is-enabled "$EARLY_BIRD_TIMER_NAME" &>/dev/null; then
	echo "✓ early bird timer: INSTALLED and enabled"
else
	echo "✗ early bird timer: NOT enabled"
fi
if systemctl --user is-enabled "$SYNC_TIMER_NAME" &>/dev/null; then
	echo "✓ workout sync timer: INSTALLED and enabled (every 15 min)"
else
	echo "✗ workout sync timer: NOT enabled"
fi

I3_CONFIG="$HOME/.config/i3/config"
if [ -f "$I3_CONFIG" ] && grep -q "exec.*screen_lock.py" "$I3_CONFIG"; then
	echo "✓ i3 autostart: INSTALLED"
else
	echo "  i3 autostart: not installed"
	echo ""
	echo "To add i3 startup hook (recommended), add this line to $I3_CONFIG:"
	echo "  exec --no-startup-id /usr/bin/python3 -m screen_locker.screen_lock --production"
fi

# Immediately check if today's workout is done; block if not.
#
# --production builds the real Tk UI and, when today is non-compliant, GRABS
# THE SCREEN and waits for a workout to be logged. That is correct for an
# interactive install, but it never returns on its own -- so when this script
# is driven non-interactively (install_core_system.sh, CI, `vm run`) the whole
# installer hangs forever on its last line. Only take the blocking path when
# there is a terminal to answer it; otherwise report status and exit.
# SCREEN_LOCKER_ENFORCE_AFTER_INSTALL=1 forces the blocking check.
echo ""
echo "=== Checking today's workout status ==="
if [ -t 0 ] || [ "${SCREEN_LOCKER_ENFORCE_AFTER_INSTALL:-0}" = "1" ]; then
	PYTHONPATH="$SCRIPT_DIR" python3 -m screen_locker.screen_lock --production
else
	echo "(non-interactive install: reporting status instead of enforcing)"
	PYTHONPATH="$SCRIPT_DIR" python3 -m screen_locker.screen_lock --status || true
	echo "Enforcement is armed via the systemd units installed above."
fi