#!/bin/bash

set -u
PATH=/usr/sbin:/usr/bin:/sbin:/bin
export PATH

security_loader="/usr/bin/deepin-security-loader"
startdde_binary="/usr/bin/startdde"

if [ ! -x "$security_loader" ]; then
    exec "$startdde_binary" "$@"
fi

umask 077

if [ -z "${XDG_RUNTIME_DIR:-}" ]; then
    echo "startdde: XDG_RUNTIME_DIR is required for security-loader supervision" >&2
    exit 1
fi

runtime_dir=$XDG_RUNTIME_DIR
while [ "$runtime_dir" != "/" ] && [ "${runtime_dir%/}" != "$runtime_dir" ]; do
    runtime_dir=${runtime_dir%/}
done
case "$runtime_dir" in
    /*) ;;
    *)
        echo "startdde: XDG_RUNTIME_DIR must be an absolute path" >&2
        exit 1
        ;;
esac

if [ -L "$runtime_dir" ] || [ ! -d "$runtime_dir" ]; then
    echo "startdde: XDG_RUNTIME_DIR must be a real directory" >&2
    exit 1
fi
runtime_owner=$(stat -c '%u' -- "$runtime_dir") || exit 1
runtime_mode=$(stat -c '%a' -- "$runtime_dir") || exit 1
if [ "$runtime_owner" != "$(id -u)" ] || [ "$runtime_mode" != "700" ]; then
    echo "startdde: XDG_RUNTIME_DIR must be owned by the current user with mode 0700" >&2
    exit 1
fi

supervisor_path_template="$runtime_dir/startdde-loader.XXXXXX/status"
if [ "${#supervisor_path_template}" -gt 4096 ]; then
    echo "startdde: supervisor FIFO path is too long" >&2
    exit 1
fi

supervisor_dir=$(mktemp -d "$runtime_dir/startdde-loader.XXXXXX") || exit 1
status_fifo="$supervisor_dir/status"
status_file="$supervisor_dir/result"
loader_pid=
monitor_pid=

stop_monitor() {
    if [ -n "${monitor_pid:-}" ]; then
        kill "$monitor_pid" 2>/dev/null || true
        wait "$monitor_pid" 2>/dev/null || true
        monitor_pid=
    fi
}

cleanup() {
    if [ -n "${loader_pid:-}" ] || [ -n "${monitor_pid:-}" ]; then
        forward_signal
    fi
    stop_monitor
    rm -rf "$supervisor_dir"
}

target_process_group() {
    if [ -f "$status_file" ]; then
        awk '$1 == "ready" && $3 ~ /^[0-9]+$/ { print $3; exit }' "$status_file"
    fi
}

forward_signal() {
    local target_pgid
    target_pgid=$(target_process_group)
    if [ -n "$target_pgid" ]; then
        kill -TERM -- "-$target_pgid" 2>/dev/null || true
    elif [ -n "${loader_pid:-}" ]; then
        kill -TERM -- "-$loader_pid" 2>/dev/null || true
    fi
}

handle_signal() {
    local exit_status=$1
    trap - HUP INT TERM
    forward_signal
    stop_monitor
    exit "$exit_status"
}

trap cleanup EXIT
trap 'handle_signal 129' HUP
trap 'handle_signal 130' INT
trap 'handle_signal 143' TERM

mkfifo "$status_fifo" || exit 1
cat "$status_fifo" >"$status_file" &
monitor_pid=$!

umask 022

STARTDDE_SUPERVISOR_FIFO="$status_fifo" \
    setsid "$security_loader" --group deepin-daemon -- \
    "$startdde_binary" "$@" &
loader_pid=$!

wait "$loader_pid"
loader_status=$?
if [ "$loader_status" -ne 0 ]; then
    forward_signal
    loader_pid=
    exit "$loader_status"
fi

wait "$monitor_pid"
monitor_pid=

loader_pid=
exit_status=$(awk '$1 == "exit" && $2 ~ /^[0-9]+$/ { status = $2 } END { if (status != "") print status }' "$status_file")
if [ -n "$exit_status" ] && [ "$exit_status" -le 255 ]; then
    exit "$exit_status"
fi

echo "startdde: no valid exit status received from loader supervisor" >&2
exit 1
