#!/usr/bin/env bash
# start-vnc.sh — Start/repair stack noVNC (idempotent & DETACHED)
# Stack: Xtigervnc :1 (5901) → websockify (6080, serves noVNC) + Chromium CDP (9222)
set -u
VD="${HOME:-/opt/data/home}/vncsetup"
RUN="$VD/run"
export LD_LIBRARY_PATH="$VD/rootfs/usr/lib/x86_64-linux-gnu"
export DISPLAY=":1"
TARGET_URL="${TARGET_URL:-https://example.com}"
QUIET=0
[ "${1:-}" = "--quiet" ] && QUIET=1
mkdir -p "$RUN"
say()  { [ "$QUIET" = "1" ] || echo "$*"; }
log()  { echo "$(date '+%F %T') $*" >> "$RUN/start-vnc.log"; }
port_up() { ( exec 3<>"/dev/tcp/127.0.0.1/$1" ) 2>/dev/null; }
xvnc_alive() { [ -f "$RUN/xvnc.pid" ] && kill -0 "$(cat "$RUN/xvnc.pid" 2>/dev/null)" 2>/dev/null; }
started_any=0
if xvnc_alive; then
  log "Xvnc sudah jalan — skip"
else
  say "→ Menjalankan Xtigervnc :1 (port 5901) ..."
  rm -f /tmp/.X1-lock /tmp/.X11-unix/X1 2>/dev/null
  setsid nohup "$VD/rootfs/usr/bin/Xtigervnc" :1 -geometry 1600x900 -depth 24 \
    -SecurityTypes None -UseBlacklist off -localhost no -rfbport 5901 \
    >"$RUN/xvnc.log" 2>&1 </dev/null &
  echo $! > "$RUN/xvnc.pid"
  for i in $(seq 1 15); do port_up 5901 && break; sleep 1; done
  if port_up 5901; then say "  ✓ Xvnc up"; started_any=1; else say "  ✗ Xvnc GAGAL — lihat $RUN/xvnc.log"; tail -5 "$RUN/xvnc.log" >&2; fi
fi
if port_up 9222; then
  log "Chrome sudah jalan — skip"
else
  say "→ Menjalankan Chromium (CDP 9222) ..."
  rm -f "$VD/chrome-profile/SingletonLock" "$VD/chrome-profile/SingletonSocket" "$VD/chrome-profile/SingletonCookie" 2>/dev/null
  setsid nohup "$VD/chrome-linux64/chrome" --no-sandbox --disable-gpu \
    --disable-dev-shm-usage --disable-notifications \
    --window-size=1600,900 --user-data-dir="$VD/chrome-profile" \
    --no-first-run --no-default-browser-check \
    --remote-debugging-port=9222 --remote-allow-origins='*' \
    "$TARGET_URL" >"$RUN/chrome.log" 2>&1 </dev/null &
  echo $! > "$RUN/chrome.pid"
  for i in $(seq 1 30); do port_up 9222 && break; sleep 1; done
  if port_up 9222; then say "  ✓ Chrome up (CDP 9222)"; started_any=1; else say "  ✗ Chrome GAGAL — lihat $RUN/chrome.log"; tail -5 "$RUN/chrome.log" >&2; fi
fi
if port_up 6080; then
  log "websockify sudah jalan — skip"
else
  say "→ Menjalankan websockify (noVNC web, port 6080, JWT auth) ..."
  # Auth: token JWT HS256 (claims host/port/exp) — secret di run/vnc-jwt-secret.
  # Token diterbitkan oleh BE platform via GET /api/v1/realtime/vnc.
  # Catatan: setelah secret di-generate, salin isinya ke user_service BE
  # (kolom vnc_jwt_secret) supaya BE bisa menerbitkan token yang valid.
  if [ ! -s "$RUN/vnc-jwt-secret" ]; then
    log "vnc-jwt-secret belum ada → generate baru"
    openssl rand -hex 32 2>/dev/null | tr -d '\n' > "$RUN/vnc-jwt-secret"
    chmod 600 "$RUN/vnc-jwt-secret"
  fi
  setsid nohup "$VD/venv/bin/websockify" --web="$VD/novnc" \
    --token-plugin=JWTTokenApi --token-source="$RUN/vnc-jwt-secret" \
    6080 \
    >"$RUN/websockify.log" 2>&1 </dev/null &
  echo $! > "$RUN/websockify.pid"
  for i in $(seq 1 10); do port_up 6080 && break; sleep 1; done
  if port_up 6080; then say "  ✓ websockify up"; started_any=1; else say "  ✗ websockify GAGAL — lihat $RUN/websockify.log"; tail -5 "$RUN/websockify.log" >&2; fi
fi
if port_up 6080 && xvnc_alive && port_up 9222; then
  code=$(curl -s -o /dev/null -w '%{http_code}' -m 5 http://localhost:6080/vnc.html 2>/dev/null)
  [ "$code" = "200" ] && say "✓ STACK LENGKAP: noVNC siap (vnc.html HTTP 200)" || say "⚠ vnc.html HTTP $code"
else
  say "⚠ Stack belum lengkap — cek log di $RUN/"
fi
[ "$QUIET" = "1" ] && [ "$started_any" = "0" ] && exit 0
exit 0