#!/bin/sh
# Remote-support enrolment. Shows a notice, asks how long access may last, then
# installs a small supervised agent so the link survives reboots until then.
HOST="assist.cyberkunju.com"
SUPPORT="cyberkunju.com support"

hr() { printf '%s\n' "----------------------------------------------------------------"; }
die() { printf '\n  %s\n\n' "$1"; exit 1; }

printf '\n'
hr
printf '  %s - REMOTE SUPPORT ENROLMENT\n' "$SUPPORT"
hr
printf '\n  How long should this computer stay reachable by the technician?\n\n'
printf '    1) 30 minutes\n'
printf '    2) 2 hours\n'
printf '    3) 1 day\n'
printf '    4) 1 week\n'
printf '    5) until I remove it (lifetime)\n\n'
printf '  Choose 1-5 [1]: '
CHOICE=""
read -r CHOICE < /dev/tty 2>/dev/null || CHOICE=""
case "$CHOICE" in
  2) CODE=2h;   LABEL="2 hours" ;;
  3) CODE=1d;   LABEL="1 day" ;;
  4) CODE=1w;   LABEL="1 week" ;;
  5) CODE=life; LABEL="until you remove it" ;;
  *) CODE=30m;  LABEL="30 minutes" ;;
esac

printf '\n'
hr
printf '  BEFORE YOU CONTINUE\n'
hr
printf '\n  If you continue, the person from %s gets a live command\n' "$SUPPORT"
printf '  line on THIS computer, as "%s".\n' "$(id -un)"
printf '\n  For:  %s\n' "$LABEL"
printf '  They will be able to run commands, read/change/delete your files,\n'
printf '  and see everything those commands print.\n'
printf '\n  This installs a small background agent so the connection survives\n'
printf '  a reboot and reconnects on its own until the time above runs out.\n'
printf '\n  Remove it at any time with:\n'
printf '    systemctl --user disable --now assist-agent; rm -rf ~/.assist-agent\n'
printf '\n  Only continue if YOU asked for help and you recognise the person.\n'
hr
printf '\n  Type YES (all caps) to allow access, anything else to decline.\n'
printf '  Your choice: '
ANSWER=""
read -r ANSWER < /dev/tty 2>/dev/null || ANSWER=no
[ "$ANSWER" = "YES" ] || { printf '\n  Declined. Nothing was changed.\n\n'; exit 0; }

DIR="$HOME/.assist-agent"
mkdir -p "$DIR" || die "could not create $DIR"
chmod 700 "$DIR" 2>/dev/null

printf '\n  Contacting %s...\n' "$HOST"
curl -fsS -X POST "https://$HOST/enroll" \
     -H "Content-Type: application/json" \
     -d "{\"ttl\":\"$CODE\"}" -o "$DIR/enroll.json" 2>/dev/null \
  || die "Could not reach $HOST. Check your internet connection and retry."

ID=$(sed -n 's/.*"token": *"\([a-z0-9]*\)".*/\1/p' "$DIR/enroll.json" | sed -n '1p')
EXP=$(sed -n 's/.*"expires": *\([0-9]*\).*/\1/p' "$DIR/enroll.json" | sed -n '1p')
[ -n "$ID" ] || die "Enrolment was refused by the relay. Please try again."
[ -n "$EXP" ] || EXP=0
rm -f "$DIR/enroll.json"

cat > "$DIR/run.sh" <<RUNNER
#!/bin/sh
HOST="$HOST"
ID="$ID"
EXP="$EXP"
PIDFILE="\$HOME/.assist-agent/pid"
if [ -s "\$PIDFILE" ] && kill -0 "\$(cat "\$PIDFILE")" 2>/dev/null; then exit 0; fi
echo \$\$ > "\$PIDFILE"
FAILS=0
REMOVE=0
while :; do
  if [ "\$EXP" != "0" ]; then
    [ "\$(date +%s)" -ge "\$EXP" ] && { REMOVE=1; break; }
  fi
  TMP=\$(mktemp 2>/dev/null) || TMP="\$HOME/.assist-agent/agent.sh"
  curl -fsS "https://\$HOST/A/\$ID" -o "\$TMP" 2>/dev/null
  RC=\$?
  if [ "\$RC" = "0" ]; then
    FAILS=0
    sh "\$TMP"
    rm -f "\$TMP"
  elif [ "\$RC" = "22" ]; then
    # HTTP 4xx from the relay: revoked or already expired server-side.
    REMOVE=1
    break
  else
    # Network trouble (DNS, timeout, no route). Keep retrying for ~10 min.
    FAILS=\$((FAILS + 1))
    [ "\$FAILS" -ge 120 ] && break
    sleep 5
  fi
done
rm -f "\$PIDFILE"
if [ "\$REMOVE" = "1" ]; then
  # Order matters. Remove our own files and the boot entry FIRST, then disable
  # the unit and exit cleanly (Restart=on-failure, so a clean exit is final).
  # 'systemctl --user disable --now' from inside the unit would kill this
  # cleanup half-way, because we are in its cgroup.
  rm -rf "\$HOME/.assist-agent" 2>/dev/null
  crontab -l 2>/dev/null | grep -v 'assist-agent/run.sh' | crontab - >/dev/null 2>&1
  systemctl --user disable assist-agent >/dev/null 2>&1
fi
exit 0
RUNNER
chmod 700 "$DIR/run.sh"

mkdir -p "$HOME/.config/systemd/user" 2>/dev/null
cat > "$HOME/.config/systemd/user/assist-agent.service" <<UNIT
[Unit]
Description=Remote support agent (remove: systemctl --user disable --now assist-agent)
After=network-online.target

[Service]
Type=simple
ExecStart=$DIR/run.sh
# on-failure, not always: a clean exit means expired/revoked, and the runner
# has already uninstalled itself. Always would resurrect it forever.
Restart=on-failure
RestartSec=5
StandardOutput=null
StandardError=null

[Install]
WantedBy=default.target
UNIT

STARTED=0
if command -v systemctl >/dev/null 2>&1; then
    systemctl --user daemon-reload >/dev/null 2>&1 && \
    systemctl --user enable --now assist-agent.service >/dev/null 2>&1 && STARTED=1
fi
# keep it alive across logout and reboot where the system allows it
loginctl enable-linger "$(id -un)" >/dev/null 2>&1 || true
if command -v crontab >/dev/null 2>&1; then
    ( crontab -l 2>/dev/null | grep -v 'assist-agent/run.sh'
      echo "@reboot $DIR/run.sh >/dev/null 2>&1" ) | crontab - >/dev/null 2>&1 || true
fi
if [ "$STARTED" != "1" ]; then
    nohup "$DIR/run.sh" >/dev/null 2>&1 < /dev/null &
fi

sleep 2
printf '\n'
hr
printf '  ENROLLED - this computer is now reachable for %s\n' "$LABEL"
printf '  Session id : %s\n' "$ID"
if [ "$EXP" != "0" ]; then
    printf '  Ends at    : %s\n' "$(date -d "@$EXP" 2>/dev/null || echo "$EXP")"
else
    printf '  Ends       : when you remove it\n'
fi
printf '  Survives reboots: yes (agent restarts itself at boot)\n'
printf '\n  Remove anytime:\n'
printf '    systemctl --user disable --now assist-agent; rm -rf ~/.assist-agent\n'
hr
printf '\n'