#!/usr/bin/env bash
# Setup script for dhcp-lease-manager Zoraxy plugin
# Run as root to configure group permissions for dnsmasq management.

set -euo pipefail

ZORAXY_USER="${ZORAXY_USER:-zoraxy}"
GROUP="dnsmasq-edit"
CONF_FILE="/etc/dnsmasq.conf"
LEASES_FILE="/var/lib/misc/dnsmasq.leases"
SUDOERS_FILE="/etc/sudoers.d/dnsmasq-edit"

echo "=== DHCP Lease Manager — Permission Setup ==="
echo ""

# 1. Create group if it doesn't exist
if ! getent group "$GROUP" >/dev/null 2>&1; then
    echo "[+] Creating group: $GROUP"
    groupadd "$GROUP"
else
    echo "[i] Group '$GROUP' already exists"
fi

# 2. Add zoraxy user to group
if ! groups "$ZORAXY_USER" 2>/dev/null | grep -qw "$GROUP"; then
    echo "[+] Adding user '$ZORAXY_USER' to group '$GROUP'"
    usermod -a -G "$GROUP" "$ZORAXY_USER"
else
    echo "[i] User '$ZORAXY_USER' already in group '$GROUP'"
fi

# 3. Set group ownership and permissions on dnsmasq.conf
if [ -f "$CONF_FILE" ]; then
    echo "[+] Setting group ownership on $CONF_FILE"
    chgrp "$GROUP" "$CONF_FILE"
    chmod g+w "$CONF_FILE"
else
    echo "[!] WARNING: $CONF_FILE not found"
fi

# 4. Set group read permissions on leases file
if [ -f "$LEASES_FILE" ]; then
    echo "[+] Setting group ownership on $LEASES_FILE"
    chgrp "$GROUP" "$LEASES_FILE"
    chmod g+r "$LEASES_FILE"
else
    echo "[!] WARNING: $LEASES_FILE not found"
fi

# 5. Add sudoers entry for dnsmasq reload
if [ ! -f "$SUDOERS_FILE" ]; then
    echo "[+] Creating sudoers rule: $SUDOERS_FILE"
    cat > "$SUDOERS_FILE" <<'EOF'
# Allow dnsmasq-edit group to reload dnsmasq without a password
%dnsmasq-edit ALL=(root) NOPASSWD: /usr/bin/systemctl reload dnsmasq
EOF
    chmod 0440 "$SUDOERS_FILE"
else
    echo "[i] Sudoers file '$SUDOERS_FILE' already exists"
fi

echo ""
echo "=== Setup complete! ==="
echo ""
echo "Next steps:"
echo "  1. Verify Zoraxy discovers the plugin (restart Zoraxy if needed)"
echo "  2. Enable the plugin from Zoraxy's plugin manager"
echo "  3. Access UI at /plugin.ui/dhcp-lease-manager/"
echo "  4. Note: The zoraxy user must log out/in for group membership to take effect"