#!/bin/zsh
# screen-sharing-credentials — manage SCRELAY_PASS in macOS Keychain so
# clicker-vnc can authenticate to com.apple.screensharingd in the background
# without prompting the user every time.
#
# Why this exists:
#   bin/clicker-vnc requires SCRELAY_USER + SCRELAY_PASS env vars (Mac account
#   password or VNC password) to authenticate over RFB+ARD. AI agents run in
#   non-interactive shells and don't have stable access to those secrets.
#   Storing them once in the user's login Keychain lets the wrapper read them
#   on demand — keychain access is gated by the user's macOS login session, not
#   by an interactive password prompt for every run.
#
# Usage:
#   screen-sharing-credentials save     [--user $USER] [--account-password]
#   screen-sharing-credentials load                                  # prints export lines
#   screen-sharing-credentials eval                                  # `eval "$(...)"` to populate env
#   screen-sharing-credentials delete
#   screen-sharing-credentials probe                                 # dry-run via clicker-vnc selftest
#
# Storage:
#   service = "HelperAI Screen Sharing"
#   account = $USER (or --user value)
#   keychain item kind = "generic-password"
#
# Examples:
#   screen-sharing-credentials save --account-password         # prompts once via osascript
#   eval "$(screen-sharing-credentials eval)" && clicker-vnc click 100 100
set -euo pipefail
BIN_DIR=${0:A:h}

SERVICE="HelperAI Screen Sharing"
SCRELAY_AUTH_DEFAULT="ard"
KEYCHAIN_USER="${USER:-$(/usr/bin/id -un)}"
ACTION="${1:-help}"
shift || true

usage() {
  awk 'NR == 1 { next } /^set -/ { exit } { sub(/^# ?/, ""); print }' "${(%):-%x}"
}

case "$ACTION" in
  -h|--help|help|"")
    usage
    exit 0
    ;;
esac

while [[ $# -gt 0 ]]; do
  case "$1" in
    --user) KEYCHAIN_USER="$2"; shift 2;;
    --auth) SCRELAY_AUTH_DEFAULT="$2"; shift 2;;
    --account-password) PROMPT_KIND="account"; shift;;
    --vnc-password)     PROMPT_KIND="vnc"; shift;;
    *) echo "screen-sharing-credentials: unknown arg: $1" >&2; exit 2;;
  esac
done

prompt_password() {
  local label="${1:-Screen Sharing password}"
  /usr/bin/osascript <<APPLESCRIPT 2>/dev/null
display dialog "$label for HelperAI clicker-vnc" with title "HelperAI" default answer "" with hidden answer buttons {"Cancel", "Save"} default button "Save"
return text returned of result
APPLESCRIPT
}

case "$ACTION" in
  save)
    label="Mac account password"
    if [[ "${PROMPT_KIND:-}" = "vnc" ]]; then
      label="VNC viewer password"
      SCRELAY_AUTH_DEFAULT="vnc"
    fi
    pw=$(prompt_password "$label" || true)
    if [[ -z "${pw:-}" ]]; then
      echo "screen-sharing-credentials: aborted (no password entered)" >&2
      exit 1
    fi
    /usr/bin/security delete-generic-password -s "$SERVICE" -a "$KEYCHAIN_USER" >/dev/null 2>&1 || true
    /usr/bin/security add-generic-password \
      -s "$SERVICE" \
      -a "$KEYCHAIN_USER" \
      -D "HelperAI Screen Sharing credential" \
      -j "Auth=$SCRELAY_AUTH_DEFAULT" \
      -w "$pw"
    echo "saved $SERVICE for account=$KEYCHAIN_USER auth=$SCRELAY_AUTH_DEFAULT"
    ;;
  load)
    pw=$(/usr/bin/security find-generic-password -s "$SERVICE" -a "$KEYCHAIN_USER" -w 2>/dev/null || true)
    if [[ -z "$pw" ]]; then
      echo "screen-sharing-credentials: no entry in Keychain for service='$SERVICE' account='$KEYCHAIN_USER' (run 'save' first)" >&2
      exit 1
    fi
    auth_attr=$(/usr/bin/security find-generic-password -s "$SERVICE" -a "$KEYCHAIN_USER" 2>/dev/null | /usr/bin/awk -F'"' '/"icmt"<blob>/ {print $2}' || true)
    if [[ "$auth_attr" =~ "Auth=" ]]; then
      auth="${auth_attr#Auth=}"
    else
      auth="$SCRELAY_AUTH_DEFAULT"
    fi
    printf 'export SCRELAY_USER=%q\n' "$KEYCHAIN_USER"
    printf 'export SCRELAY_PASS=%q\n' "$pw"
    if [[ "$auth" = "vnc" ]]; then
      printf 'export SCRELAY_AUTH=vnc\n'
    else
      printf 'unset SCRELAY_AUTH\n'
    fi
    ;;
  eval)
    exec "$0" load
    ;;
  delete)
    /usr/bin/security delete-generic-password -s "$SERVICE" -a "$KEYCHAIN_USER" >/dev/null 2>&1 || true
    echo "deleted $SERVICE for account=$KEYCHAIN_USER"
    ;;
  probe)
    eval "$($0 load)"
    "$BIN_DIR/clicker-vnc" selftest
    ;;
  *)
    echo "screen-sharing-credentials: unknown action: $ACTION" >&2
    usage
    exit 2
    ;;
esac
