#!/usr/bin/env bash
# policy: dev_daemon — enable or disable systemd units via FreeIPA host-groups.
#   dev_daemon-enable-<unit>   ensure the unit is enabled and running
#   dev_daemon-disable-<unit>  ensure the unit is disabled and stopped
# Conflicts (same unit in both lists) are skipped with a warning.

DAEMON_ENABLE_STATE="$STATE_DIR/daemon-enabled"
DAEMON_DISABLE_STATE="$STATE_DIR/daemon-disabled"
[[ -f "$DAEMON_ENABLE_STATE"  ]] || touch "$DAEMON_ENABLE_STATE"
[[ -f "$DAEMON_DISABLE_STATE" ]] || touch "$DAEMON_DISABLE_STATE"

_svc_unit()      { [[ "$1" == *.* ]] && echo "$1" || echo "${1}.service"; }
_in_enable_list()  { local n="$1"; for s in "${ACTIVE_DAEMON_ENABLE[@]}";  do [[ "$s" == "$n" ]] && return 0; done; return 1; }
_in_disable_list() { local n="$1"; for s in "${ACTIVE_DAEMON_DISABLE[@]}"; do [[ "$s" == "$n" ]] && return 0; done; return 1; }

# Apply enable policies
for _SVC in "${ACTIVE_DAEMON_ENABLE[@]+"${ACTIVE_DAEMON_ENABLE[@]}"}"; do
    if _in_disable_list "$_SVC"; then
        warn "Conflict: '$_SVC' is in both daemon-enable and daemon-disable groups — skipped"
        continue
    fi
    _UNIT=$(_svc_unit "$_SVC")
    _EN=$(systemctl is-enabled "$_UNIT" 2>/dev/null || echo "not-found")
    _AC=$(systemctl is-active  "$_UNIT" 2>/dev/null || echo "inactive")
    if [[ "$_EN" != "enabled" || "$_AC" != "active" ]]; then
        log "Enabling service: $_UNIT (enabled=$_EN active=$_AC)"
        systemctl enable --now "$_UNIT" 2>/dev/null \
            && log "Service enabled: $_UNIT" \
            || warn "Failed to enable $_UNIT — unit may not exist on this host"
    fi
done

# Apply disable policies
for _SVC in "${ACTIVE_DAEMON_DISABLE[@]+"${ACTIVE_DAEMON_DISABLE[@]}"}"; do
    if _in_enable_list "$_SVC"; then
        continue  # conflict already warned above
    fi
    _UNIT=$(_svc_unit "$_SVC")
    _EN=$(systemctl is-enabled "$_UNIT" 2>/dev/null || echo "not-found")
    _AC=$(systemctl is-active  "$_UNIT" 2>/dev/null || echo "inactive")
    if [[ "$_EN" == "enabled" || "$_AC" == "active" ]]; then
        log "Disabling service: $_UNIT (enabled=$_EN active=$_AC)"
        systemctl disable --now "$_UNIT" 2>/dev/null \
            && log "Service disabled: $_UNIT" \
            || warn "Failed to disable $_UNIT — unit may not exist on this host"
    fi
done

# Revert: host left a daemon-enable group → disable and stop the service
while IFS= read -r _OLD; do
    [[ -z "$_OLD" ]] && continue
    if ! _in_enable_list "$_OLD"; then
        _UNIT=$(_svc_unit "$_OLD")
        log "Reverting enable policy: disabling $_UNIT (host left daemon-enable group)"
        systemctl disable --now "$_UNIT" 2>/dev/null \
            || warn "Failed to disable (revert) $_UNIT"
    fi
done < "$DAEMON_ENABLE_STATE"

# Revert: host left a daemon-disable group → re-enable and start the service
while IFS= read -r _OLD; do
    [[ -z "$_OLD" ]] && continue
    if ! _in_disable_list "$_OLD"; then
        _UNIT=$(_svc_unit "$_OLD")
        log "Reverting disable policy: enabling $_UNIT (host left daemon-disable group)"
        systemctl enable --now "$_UNIT" 2>/dev/null \
            || warn "Failed to enable (revert) $_UNIT"
    fi
done < "$DAEMON_DISABLE_STATE"

# Persist current state
if [[ ${#ACTIVE_DAEMON_ENABLE[@]} -gt 0 ]]; then
    printf '%s\n' "${ACTIVE_DAEMON_ENABLE[@]}" | sort -u > "$DAEMON_ENABLE_STATE"
else
    > "$DAEMON_ENABLE_STATE"
fi
if [[ ${#ACTIVE_DAEMON_DISABLE[@]} -gt 0 ]]; then
    printf '%s\n' "${ACTIVE_DAEMON_DISABLE[@]}" | sort -u > "$DAEMON_DISABLE_STATE"
else
    > "$DAEMON_DISABLE_STATE"
fi
unset _SVC _UNIT _EN _AC _OLD