#!/bin/bash
# alpha-cron — allow-listed root helper to manage panel-created cron jobs in
# a single managed file. Called as: sudo -n /usr/local/sbin/alpha-cron <action> [args]
set -euo pipefail
F=/etc/cron.d/alpha-panel-jobs

vid(){ [[ "${1:-}" =~ ^[a-f0-9]{8,16}$ ]] || { echo BAD_ID; exit 2; }; }
vuser(){ [[ "${1:-}" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]] && id "$1" >/dev/null 2>&1 || { echo BAD_USER; exit 2; }; }
vsched(){
  local s="$1"
  case "$s" in
    @reboot|@hourly|@daily|@weekly|@monthly|@yearly|@annually|@midnight) return 0 ;;
  esac
  [[ "$s" =~ ^[0-9*,/[:space:]-]+$ ]] || { echo BAD_SCHED; exit 2; }
  [ "$(echo "$s" | wc -w)" -eq 5 ] || { echo BAD_SCHED; exit 2; }
}
ensure(){ [ -f "$F" ] || { printf '# Alpha Panel managed cron jobs — edit via the panel (Cron Job Manager)\n' > "$F"; chmod 644 "$F"; chown root:root "$F"; }; }

a="${1:-}"; shift || true
case "$a" in
  list)
    [ -f "$F" ] && grep -E '# alpha-id:[a-f0-9]+$' "$F" || true ;;
  add)
    id="${1:-}"; user="${2:-}"; sched="${3:-}"; cmd="${4:-}"
    vid "$id"; vuser "$user"; vsched "$sched"
    [ -n "$cmd" ] || { echo BAD_CMD; exit 2; }
    case "$cmd" in *$'\n'*|*$'\r'*) echo BAD_CMD; exit 2 ;; esac
    ensure
    printf '%s %s %s # alpha-id:%s\n' "$sched" "$user" "$cmd" "$id" >> "$F"
    chmod 644 "$F"; echo OK ;;
  del)
    id="${1:-}"; vid "$id"
    [ -f "$F" ] || { echo OK; exit 0; }
    sed -i "/# alpha-id:$id\$/d" "$F"
    echo OK ;;
  *) echo UNKNOWN_ACTION; exit 2 ;;
esac
