#!/usr/bin/env bash
set -euo pipefail
APP="Sentinel Password Vault"
BIN="sentinel-password-vault"
CLEAN=0
for arg in "$@"; do
  case "$arg" in
    --clean-shadow) CLEAN=1 ;;
    -h|--help) echo "Usage: $0 [--clean-shadow]"; exit 0 ;;
    *) echo "Unknown option: $arg" >&2; exit 2 ;;
  esac
done
if [ "${EUID:-$(id -u)}" -eq 0 ]; then
  echo "ERROR: Do not run $0 as root. Run it as the normal desktop user." >&2
  exit 13
fi
mkdir -p "$HOME/.local/share/sentinel-password-vault" "$HOME/.local/share/sentinel-password-vault/backups" "$HOME/.local/state/sentinel-password-vault" "$HOME/.config/sentinel-password-vault" "$HOME/.local/share/applications"
chmod 700 "$HOME/.local/share/sentinel-password-vault" "$HOME/.local/share/sentinel-password-vault/backups" "$HOME/.local/state/sentinel-password-vault" "$HOME/.config/sentinel-password-vault"
if [ "$CLEAN" -eq 1 ]; then
  TS=$(date +%Y%m%d-%H%M%S)
  for p in "$HOME/.local/bin/$BIN" "$HOME/.local/share/applications/sentinel-password-vault.desktop"; do
    if [ -e "$p" ]; then
      mv "$p" "$p.shadowed-$TS"
      echo "Moved user shadow: $p"
    fi
  done
fi
DESK="$HOME/Desktop"
[ -d "$DESK" ] || DESK="$HOME/desktop"
mkdir -p "$DESK"
cat > "$DESK/Sentinel Password Vault.desktop" <<EOF
[Desktop Entry]
Type=Application
Name=Sentinel Password Vault
Comment=Local encrypted password vault for SentinelOS
Exec=/usr/bin/sentinel-password-vault
Icon=/usr/share/icons/hicolor/256x256/apps/sentinel-password-vault.png
Terminal=false
Categories=Utility;Security;
StartupNotify=true
EOF
chmod 755 "$DESK/Sentinel Password Vault.desktop"
if command -v gio >/dev/null 2>&1; then
  gio set "$DESK/Sentinel Password Vault.desktop" metadata::trusted true >/dev/null 2>&1 || true
fi
if command -v update-desktop-database >/dev/null 2>&1; then update-desktop-database "$HOME/.local/share/applications" >/dev/null 2>&1 || true; fi
echo "$APP user setup complete."
echo "Desktop launcher: $DESK/Sentinel Password Vault.desktop"
