#!/bin/bash
# install-console-wrapper.sh — one-shot remediation for existing hosts
# that installed before the monsys-console-launch wrapper existed. Run as root:
#
#   curl -fsSL https://get.monsys.ai/install-console-wrapper.sh | sudo bash
#
# After this finishes, restart the agent (sudo systemctl restart monsys-agent)
# and the emergency console will work on its next session attempt.

set -e

if [[ $EUID -ne 0 ]]; then
    echo "must run as root" >&2
    exit 1
fi

# Ensure monsys-console user exists (was created by install.sh).
if ! id monsys-console >/dev/null 2>&1; then
    echo "creating monsys-console user"
    useradd -r -s /bin/bash -d /var/lib/monsys/console -c "Monsys Emergency Console" monsys-console
    install -d -o monsys-console -g monsys-console -m 0750 /var/lib/monsys/console
fi

echo "installing /usr/local/sbin/monsys-console-launch"
install -m 0755 -o root -g root /dev/stdin /usr/local/sbin/monsys-console-launch <<'WRAPPER'
#!/bin/bash
set -e
SESSION_ID="${1:?session_id required}"
if ! [[ "$SESSION_ID" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]]; then
    echo "monsys-console-launch: invalid session_id" >&2
    exit 2
fi
if ! id monsys-console >/dev/null 2>&1; then
    echo "monsys-console-launch: monsys-console user missing" >&2
    exit 3
fi
export MONSYS_SESSION_ID="$SESSION_ID"
export TERM="${TERM:-xterm-256color}"
export HOME="/var/lib/monsys/console"
export PATH="/usr/bin:/usr/sbin:/bin:/sbin"
export SHELL="/bin/bash"
export PS1="monsys-console:\w\$ "
exec setpriv --reuid=monsys-console --regid=monsys-console --init-groups --inh-caps=-all -- \
    /bin/bash --rcfile /var/lib/monsys/console/.bashrc --restricted -i
WRAPPER

echo "installing /etc/sudoers.d/monsys-console"
install -m 0440 -o root -g root /dev/stdin /etc/sudoers.d/monsys-console <<'SUDOERS'
monsys ALL=(root) NOPASSWD: /usr/local/sbin/monsys-console-launch *
Defaults!/usr/local/sbin/monsys-console-launch !requiretty
SUDOERS
visudo -c -f /etc/sudoers.d/monsys-console >/dev/null

# Strip the obsolete (and now harmful) AmbientCapabilities + CapabilityBoundingSet
# lines from earlier broken install.sh / drop-ins. They restrict cap inheritance
# so even root-uid sudo children miss CAP_DAC_OVERRIDE → monsys-update apply
# fails with "rm: Permission denied" when cleaning the staging file.
UNIT=/etc/systemd/system/monsys-agent.service
DROPIN=/etc/systemd/system/monsys-agent.service.d/console-caps.conf
NEEDS_RELOAD=0

if [[ -f "$DROPIN" ]]; then
    echo "removing obsolete console-caps.conf drop-in"
    rm "$DROPIN"
    NEEDS_RELOAD=1
fi
if grep -qE "^(AmbientCapabilities|CapabilityBoundingSet)=" "$UNIT"; then
    echo "stripping AmbientCapabilities/CapabilityBoundingSet from $UNIT"
    sed -i.bak-$(date +%s) -E "/^(AmbientCapabilities|CapabilityBoundingSet)=/d" "$UNIT"
    NEEDS_RELOAD=1
fi
if [[ "$NEEDS_RELOAD" -eq 1 ]]; then
    systemctl daemon-reload
fi

echo "✓ wrapper installed. restart the agent to pick up the new binary + flow:"
echo "    sudo systemctl restart monsys-agent"