#!/bin/bash
# lib/steps/sudoers.sh — sudoers + directorios XDG

step_sudoers() {
    print_section "Permissions & Directories"
    log_step "sudoers + XDG directories" 6 $TOTAL_STEPS

    _setup_sudoers
    _create_directories
}

_setup_sudoers() {
    local tmp
    tmp=$(mktemp)

    cat > "$tmp" << EOF
# hydraveil — generado por installer $(date '+%Y-%m-%d')
# NO editar manualmente
Defaults!${SINGBOX_WRAPPER} !requiretty
${USER} ALL=(root) NOPASSWD: ${SINGBOX_WRAPPER}
EOF

    if ! sudo visudo -c -f "$tmp" &>/dev/null; then
        rm -f "$tmp"
        log_error "sudoers inválido — abortando para evitar lockout"
        exit 1
    fi

    sudo cp "$tmp" "$SUDOERS_PATH"
    sudo chmod 440 "$SUDOERS_PATH"
    rm -f "$tmp"
    log_ok "sudoers instalado → ${SUDOERS_PATH}"
}

_create_directories() {
    local -a dirs=(
        # XDG data
        "$HV_DATA_DIR/configs"
        "$HV_DATA_DIR/runtime"
        "$HV_DATA_DIR/applications"
        "$HV_DATA_DIR/profiles"
        "$HV_DATA_DIR/ticket_data"
        "$HV_DATA_DIR/incidents"
        # XDG config
        "$HV_CONFIG_DIR/profiles"
        "$HV_CONFIG_DIR/ticketing"
        # XDG state
        "$HV_STATE_DIR/sessions"
        "$HV_STATE_DIR/tor"
        # XDG cache
        "$HV_CACHE_DIR"
    )

    for dir in "${dirs[@]}"; do
        mkdir -p "$dir"
        chmod 700 "$dir"
        log_ok "→ ${dir}"
    done

    # Log file con permisos de usuario ANTES de que el wrapper lo toque
    local log_file="$SINGBOX_LOG_FILE"
    if [ ! -f "$log_file" ]; then
        touch "$log_file"
        chmod 600 "$log_file"
        log_ok "Log file creado → ${log_file}"
    else
        log_ok "Log file ya existe → ${log_file}"
    fi
}