#!/usr/bin/env bash
# 生成面板密码与 Clash API 密钥（如 .env 中尚未配置）
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT_DIR="$(dirname "$SCRIPT_DIR")"
ENV_FILE="${ROOT_DIR}/.env"

if ! command -v sing-box &>/dev/null; then
  echo "sing-box 未安装，使用临时下载..." >&2
  TMP="$(mktemp -d)"
  ARCH="$(uname -m)"
  case "$ARCH" in
    x86_64)  SB_ARCH="amd64" ;;
    aarch64) SB_ARCH="arm64" ;;
    *) echo "不支持的架构: $ARCH" >&2; exit 1 ;;
  esac
  curl -fsSL "https://github.com/SagerNet/sing-box/releases/download/v1.11.0/sing-box-1.11.0-linux-${SB_ARCH}.tar.gz" \
    | tar -xz -C "$TMP" --strip-components=1
  SB="$TMP/sing-box"
else
  SB="sing-box"
fi

GENERATE_PANEL_PASSWORD=1
if [[ -f "$ENV_FILE" ]] && grep -q "^PANEL_PASSWORD=.\+" "$ENV_FILE" 2>/dev/null; then
  GENERATE_PANEL_PASSWORD=0
  PANEL_PASSWORD="$(grep "^PANEL_PASSWORD=" "$ENV_FILE" | cut -d= -f2-)"
fi
if (( GENERATE_PANEL_PASSWORD )); then
  PANEL_PASSWORD="$("$SB" generate rand --base64 32 | tr -d '/+=' | head -c 20)"
fi

echo "========== 生成的密钥 =========="
if (( GENERATE_PANEL_PASSWORD )); then
  echo "PANEL_PASSWORD:      $PANEL_PASSWORD"
else
  echo "PANEL_PASSWORD:      （保留 .env 中已有密码，未重新生成）"
fi
echo "================================"

if [[ -f "$ENV_FILE" ]]; then
  if (( GENERATE_PANEL_PASSWORD )); then
    if grep -q "^PANEL_PASSWORD=" "$ENV_FILE" 2>/dev/null; then
      sed -i "s|^PANEL_PASSWORD=.*|PANEL_PASSWORD=${PANEL_PASSWORD}|" "$ENV_FILE"
    else
      echo "PANEL_PASSWORD=${PANEL_PASSWORD}" >> "$ENV_FILE"
    fi
  fi
  if ! grep -q "^PANEL_USERNAME=" "$ENV_FILE" 2>/dev/null; then
    echo "PANEL_USERNAME=dekun" >> "$ENV_FILE"
  fi
  echo "已写入 $ENV_FILE"
else
  echo "提示: 先复制 .env.example 为 .env 并填写 VPS_IP、DOMAIN 等" >&2
fi