#!/bin/bash
set -euo pipefail

USERNAME="$1"
HASHED_PASSWORD="$2"
SSH_KEY="$3"

echo "Creating admin user: $USERNAME"

# --- Install dependencies early
if command -v dnf &>/dev/null; then
  dnf install -y zsh git curl sudo util-linux-user
elif command -v apt-get &>/dev/null; then
  apt-get update
  apt-get install -y zsh git curl sudo
else
  echo "Unsupported package manager"
  exit 1
fi

# --- Create user if not exists
if ! id "$USERNAME" &>/dev/null; then
  useradd -m -s /bin/zsh "$USERNAME"
  echo "${USERNAME}:${HASHED_PASSWORD}" | chpasswd -e
# Disable forced password change and expiration
chage -M 99999 -I -1 -E -1 "$USERNAME"
else
  echo "User $USERNAME already exists, skipping creation"
fi

USER_HOME=$(eval echo "~$USERNAME")

# --- Create fastfetch config
mkdir -p "$USER_HOME/.config/fastfetch"
cat <<'EOF' > "$USER_HOME/.config/fastfetch/config.jsonc"
{
  "displayMode": "default",
  "modules": [
    "os", "host", "kernel", "uptime", "packages", "shell",
    "cpu", "memory",
    {
      "type": "disk",
      "folders": ["/", "/home", "/tmp", "/var", "/var/log", "/var/log/audit", "/var/tmp"]
    },
    "locale"
  ]
}
EOF

chown -R "$USERNAME:$USERNAME" "$USER_HOME/.config"
chmod -R 700 "$USER_HOME/.config"

# --- SSH Setup
mkdir -p "$USER_HOME/.ssh"
echo "$SSH_KEY" > "$USER_HOME/.ssh/authorized_keys"
chmod 700 "$USER_HOME/.ssh"
chmod 600 "$USER_HOME/.ssh/authorized_keys"
chown -R "$USERNAME:$USERNAME" "$USER_HOME/.ssh"

# --- Groups and Sudo
if ! getent group docker >/dev/null; then
  groupadd docker
fi

if getent group sudo >/dev/null; then
  usermod -aG sudo,docker "$USERNAME"
elif getent group wheel >/dev/null; then
  usermod -aG wheel,docker "$USERNAME"
else
  echo "No sudo-equivalent group found, skipping"
fi

echo "$USERNAME ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/99_$USERNAME"
chmod 440 "/etc/sudoers.d/99_$USERNAME"

# --- Install Oh My Zsh and config as the user
runuser -l "$USERNAME" -c 'export RUNZSH=no CHSH=no KEEP_ZSHRC=yes && \
  sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" --unattended'

# --- Install autosuggestions plugin
runuser -l "$USERNAME" -c "git clone https://github.com/zsh-users/zsh-autosuggestions \
  ~/.oh-my-zsh/custom/plugins/zsh-autosuggestions"

# --- Generate custom .zshrc
cat << 'EOF' > "$USER_HOME/.zshrc"
export ZSH="\$HOME/.oh-my-zsh"
ZSH_THEME="robbyrussell"
plugins=(git zsh-autosuggestions)
source \$ZSH/oh-my-zsh.sh

PS1='%F{51}%n%F{255}@%F{227}%m %F{84}%~%f %F{15}$ '
fastfetch
EOF

chown "$USERNAME:$USERNAME" "$USER_HOME/.zshrc"
chmod 644 "$USER_HOME/.zshrc"

# --- Set shell (do this last to avoid breaking script if user shell changes mid-run)
chsh -s "$(command -v zsh)" "$USERNAME"

# --- Deny admin from using Ansible
cat <<EOF > /etc/sudoers.d/99_no_ansible_for_admin
$USERNAME ALL=(ALL) !/usr/bin/ansible, !/usr/bin/ansible-playbook
EOF

chmod 440 /etc/sudoers.d/99_no_ansible_for_admin

echo "✅ User $USERNAME configured successfully"