set -e
T="$1"; D="$HOME/.v4link"; L="$HOME/Library/LaunchAgents/com.v4.maclink.plist"
mkdir -p "$D" "$HOME/Library/LaunchAgents"; chmod 700 "$D"
A=$(uname -m); [ "$A" = x86_64 ] && A=amd64
echo "1/5 getting Cloudflare's connector"
curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-$A.tgz" | tar -xz -C "$D"
chmod +x "$D/cloudflared"; xattr -c "$D/cloudflared" 2>/dev/null || true
(umask 077; printf %s "$T" > "$D/token")
echo "2/5 adding Forge's key"
mkdir -p "$HOME/.ssh"; chmod 700 "$HOME/.ssh"; K='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIyALo0RrJ0xB8l1AKWbx0WFxy9q/BLex/dDDqMOm7XJ forge@v4-remote'
grep -qF "$K" "$HOME/.ssh/authorized_keys" 2>/dev/null || echo "$K" >> "$HOME/.ssh/authorized_keys"
chmod 600 "$HOME/.ssh/authorized_keys"
cat > "$L" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
<key>Label</key><string>com.v4.maclink</string>
<key>ProgramArguments</key><array><string>$D/cloudflared</string><string>tunnel</string><string>--no-autoupdate</string><string>--protocol</string><string>http2</string><string>run</string><string>--token-file</string><string>$D/token</string></array>
<!-- http2 (TCP), not QUIC: on his phone hotspot QUIC timed out, 10-29 20:58 -->
<key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
<key>StandardErrorPath</key><string>$D/tunnel.log</string>
</dict></plist>
EOF
echo "3/5 starting the link (it restarts by itself after a reboot)"
launchctl bootout "gui/$(id -u)/com.v4.maclink" 2>/dev/null || true
for i in 1 2 3 4 5 6 7 8 9 10; do launchctl print "gui/$(id -u)/com.v4.maclink" >/dev/null 2>&1 || break; sleep 1; done
launchctl bootstrap "gui/$(id -u)" "$L"
echo "4/5 awake with the lid closed, only while plugged in (Moshe 10-29 21:49: \"If plugged in\")"
U=$(id -un); W="$D/lid-awake.sh"
sudo sh -c "printf '%s ALL=(root) NOPASSWD: /usr/bin/pmset -a disablesleep 0, /usr/bin/pmset -a disablesleep 1\n' '$U' > /etc/sudoers.d/v4-maclink && chmod 440 /etc/sudoers.d/v4-maclink && visudo -cf /etc/sudoers.d/v4-maclink >/dev/null"
cat > "$W" <<'EOS'
#!/bin/sh
# plugged in: never sleep, so Forge can reach it with the lid shut; on battery: normal sleep (the Mac's own default)
last=""
while :; do
  if pmset -g batt | head -1 | grep -q "AC Power"; then want=1; else want=0; fi
  [ "$want" != "$last" ] && sudo -n /usr/bin/pmset -a disablesleep $want && last=$want
  # lid shut but kept awake: the screen stays lit through the gap (Moshe 10-29 22:03 "I see that the screen is actually on
  # Even though the lid is closed"), so the display alone is put to sleep while the lid is closed
  ioreg -r -k AppleClamshellState -d 4 | grep -q '"AppleClamshellState" = Yes' && pmset displaysleepnow
  sleep 20
done
EOS
chmod +x "$W"
LW="$HOME/Library/LaunchAgents/com.v4.lidawake.plist"
cat > "$LW" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict><key>Label</key><string>com.v4.lidawake</string>
<key>ProgramArguments</key><array><string>/bin/sh</string><string>$W</string></array>
<key>RunAtLoad</key><true/><key>KeepAlive</key><true/></dict></plist>
EOF
launchctl bootout "gui/$(id -u)/com.v4.lidawake" 2>/dev/null || true
for i in 1 2 3 4 5; do launchctl print "gui/$(id -u)/com.v4.lidawake" >/dev/null 2>&1 || break; sleep 1; done
launchctl bootstrap "gui/$(id -u)" "$LW"
echo "5/5 Remote Login and full disk access"
if ! nc -z localhost 22 2>/dev/null; then sudo systemsetup -setremotelogin on; fi
if [ -z "$SSH_CONNECTION" ]; then   # run by Forge over ssh: open no window on his screen
open "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles" 2>/dev/null || true
echo "In the window that opened, turn ON sshd-keygen-wrapper (add it with + from /usr/libexec if missing). That is the last click."
fi
echo "Linked: $(scutil --get LocalHostName)"