#!/usr/bin/env bash
set -Eeuo pipefail
ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
DEST=${1:-$ROOT/build/profile}
[[ -d /usr/share/archiso/configs/releng ]] || { echo 'Install archiso first.' >&2; exit 1; }
[[ ! -e $DEST ]] || { echo "Profile already exists: $DEST" >&2; exit 1; }
bash "$ROOT/scripts/build-release.sh"
mkdir -p "$(dirname "$DEST")"
cp -a /usr/share/archiso/configs/releng "$DEST"
for pkg in cage seatd xorg-xwayland mesa vulkan-radeon vulkan-intel libglvnd fontconfig ttf-dejavu networkmanager curl ca-certificates sqlite smartmontools ffmpeg gcc glmark2 mpv pciutils util-linux e2fsprogs stress-ng memtester alsa-utils v4l-utils dmidecode python usbutils xdg-utils firefox; do
 grep -qxF "$pkg" "$DEST/packages.x86_64" || echo "$pkg" >> "$DEST/packages.x86_64"
done
mkdir -p "$DEST/airootfs/usr/local/bin" "$DEST/airootfs/usr/local/lib/pc-intake" "$DEST/airootfs/etc/systemd/system/multi-user.target.wants"
install -m755 "$ROOT/scanner/target/release/pc-intake" "$DEST/airootfs/usr/local/bin/pc-intake"
install -m755 "$ROOT/controller/target/release/intake-controller" "$DEST/airootfs/usr/local/bin/intake-controller"
install -m755 "$ROOT/gui/target/release/intake-gui" "$DEST/airootfs/usr/local/bin/intake-gui"
install -m755 "$ROOT/scripts/intake-session.sh" "$DEST/airootfs/usr/local/bin/intake-session"
# The GUI must run in a real logind session, not a root system service attached to a TTY.
install -m755 "$ROOT/live/intake-prepare.sh" "$DEST/airootfs/usr/local/bin/intake-prepare"
install -m755 "$ROOT/live/intake-login.sh" "$DEST/airootfs/usr/local/bin/intake-login"
install -m644 "$ROOT/live/intake-prepare.service" "$DEST/airootfs/etc/systemd/system/intake-prepare.service"
mkdir -p "$DEST/airootfs/etc/systemd/system/getty@tty1.service.d"
install -m644 "$ROOT/live/autologin.conf" "$DEST/airootfs/etc/systemd/system/getty@tty1.service.d/autologin.conf"
ln -s ../intake-prepare.service "$DEST/airootfs/etc/systemd/system/multi-user.target.wants/intake-prepare.service"
rm -f "$DEST/airootfs/etc/systemd/system/getty@tty1.service"
rm -f "$DEST/airootfs/etc/systemd/system/multi-user.target.wants/pc-intake.service"
rm -f "$DEST/airootfs/etc/systemd/system/pc-intake.service"
# Archiso can override copied file modes. Record explicit permissions too.
cat >> "$DEST/profiledef.sh" <<'EOF'
file_permissions+=(
  ["/usr/local/bin/intake-session"]="0:0:755"
  ["/usr/local/bin/pc-intake"]="0:0:755"
  ["/usr/local/bin/intake-controller"]="0:0:755"
  ["/usr/local/bin/intake-gui"]="0:0:755"
  ["/usr/local/bin/intake-prepare"]="0:0:755"
  ["/usr/local/bin/intake-login"]="0:0:755"
)
EOF
for path in usr/local/bin/intake-session usr/local/bin/pc-intake usr/local/bin/intake-controller usr/local/bin/intake-gui usr/local/bin/intake-prepare usr/local/bin/intake-login; do
 test -x "$DEST/airootfs/$path" || { echo "FATAL: missing executable $path" >&2; exit 1; }
done
# Optional operator-approved provisioning at build time; ISO secrets are extractable.
if [[ ${CSR_EMBED_INVENTORY_CONFIG:-0} == 1 ]]; then
  : "${CSR_PRIVATE_CONFIG_DIR:?Set CSR_PRIVATE_CONFIG_DIR to local private folder}"
  test -f "$CSR_PRIVATE_CONFIG_DIR/inventory.json"
  test -f "$CSR_PRIVATE_CONFIG_DIR/inventory-api-key"
  mkdir -p "$DEST/airootfs/etc/csr-intake"
  install -m600 "$CSR_PRIVATE_CONFIG_DIR/inventory.json" "$DEST/airootfs/etc/csr-intake/inventory.json"
  install -m600 "$CSR_PRIVATE_CONFIG_DIR/inventory-api-key" "$DEST/airootfs/etc/csr-intake/inventory-api-key"
  cat >> "$DEST/profiledef.sh" <<'PERMS'
file_permissions+=( ["/etc/csr-intake/inventory.json"]="0:0:600" ["/etc/csr-intake/inventory-api-key"]="0:0:600" )
PERMS
fi
echo "Profile created at $DEST"

# Keep NetworkManager running in the live image for LAN/WLAN diagnostics.
mkdir -p "$DEST/airootfs/etc/systemd/system/multi-user.target.wants"
ln -sfn /usr/lib/systemd/system/NetworkManager.service "$DEST/airootfs/etc/systemd/system/multi-user.target.wants/NetworkManager.service"

mkdir -p "$DEST/airootfs/etc/csr-intake"
install -m644 "$ROOT/build/release.json" "$DEST/airootfs/etc/csr-intake/release.json"
python3 "$ROOT/scripts/release-manifest.py" --verify-profile "$DEST"