#!/bin/bash
# Proven kiosk - LOCALHOST ONLY per safety boundary
set -e
MODE="${1:-dev}" # dev | prod | hello (hello only for local file test)
URL="http://localhost:5173"
BG="#2E3440"

if [ "$MODE" = "prod" ]; then
  URL="file:///home/elias/KiddOsV3/webapp/dist/index.html"
elif [ "$MODE" = "hello" ]; then
  URL="file:///home/elias/KiddOsV2/browser/hello.html"
fi

# Safety check: only allow localhost or file://
if [[ "$URL" != http://localhost* && "$URL" != http://127.0.0.1* && "$URL" != file://* ]]; then
  echo "❌ Blocked: Only localhost:5173 or file:// allowed per parent boundary! Tried: $URL"
  exit 1
fi

echo "🔒 KiddOs v3 kiosk — localhost/file only"
echo "   URL: $URL (allowed)"
echo "   BG: $BG"
echo "   Stopping old v2/v1 kiosks..."
sudo systemctl stop kiddos.service kiddos-browser.service journal-kiosk.service kiddos-v3.service 2>/dev/null || true
sudo pkill -9 cage cog 2>/dev/null || true
sudo rm -f /run/user/1000/wayland-* 2>/dev/null || true
sleep 1

if [ "$MODE" = "dev" ]; then
  if ! curl -s --connect-timeout 2 http://localhost:5173/ | grep -q "KiddOs" ; then
    echo "⚠️  Vite dev server not running on :5173!"
    echo "   Start in another SSH: cd ~/KiddOsV3/webapp && npm run dev"
    echo "   Falling back to prod file://"
    URL="file:///home/elias/KiddOsV3/webapp/dist/index.html"
  fi
fi

echo "   Starting: cage -s -- cog --platform=wl $URL"
sudo openvt -f -c 1 -s -- env XDG_RUNTIME_DIR=/run/user/1000 cage -s -- cog --platform=wl "$URL" --bg-color="$BG"