runas-remote

#!/usr/bin/env bash
set -euo pipefail

SCRIPT_PATH="$(readlink -f "${BASH_SOURCE[0]}")"
ROOT_DIR="$(cd "$(dirname "$SCRIPT_PATH")" && pwd)"
WBEAM_CONFIG_HELPER="$ROOT_DIR/host/scripts/wbeam_config.sh"
if [[ -f "$WBEAM_CONFIG_HELPER" ]]; then
  # shellcheck source=host/scripts/wbeam_config.sh
  source "$WBEAM_CONFIG_HELPER"
  wbeam_load_config "$ROOT_DIR"
fi

usage() {
  cat <<'USAGE'
Usage:
  runas-remote --list-sessions [desktop_user]
  runas-remote <desktop_user> <script_or_app_path> [-- app_args...]
  runas-remote [script_or_app_path] [-- app_args...]               # default user
  runas-remote [desktop_user]                                       # default app: ./desktop.sh

Examples:
  ./runas-remote alice ./desktop.sh
  ./runas-remote alice ./devtool -- build
  ./runas-remote alice /home/alice/bin/myapp -- --flag
  ./runas-remote ./start-remote alice

Security env options:
  RUNAS_REMOTE_PASSTHROUGH_ENV="NAME1,NAME2"  # copy selected env vars to target app
  RUNAS_REMOTE_ENV_FILE=/path/to/env.file      # KEY=VALUE lines, mode 600 recommended
  RUNAS_REMOTE_SESSION_REMOTE=any|no|yes       # filter loginctl session by Remote flag
  RUNAS_REMOTE_SESSION_ID=<sid>                # force loginctl session id
  RUNAS_REMOTE_DISPLAY=:0                      # prefer/require given DISPLAY
  RUNAS_REMOTE_QUIET=1                         # suppress startup metadata line
USAGE
}

if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
  usage
  exit 0
fi


user_exists() {
  id "$1" >/dev/null 2>&1
}

resolve_active_user_from_loginctl() {
  local sid name type state active remote
  local fallback_name=""
  while read -r sid _; do
    [[ -n "$sid" ]] || continue
    name="$(loginctl show-session "$sid" -p Name --value 2>/dev/null || true)"
    type="$(loginctl show-session "$sid" -p Type --value 2>/dev/null || true)"
    state="$(loginctl show-session "$sid" -p State --value 2>/dev/null || true)"
    active="$(loginctl show-session "$sid" -p Active --value 2>/dev/null || true)"
    remote="$(loginctl show-session "$sid" -p Remote --value 2>/dev/null || true)"

    if [[ -n "$name" && "$name" != "root" ]] && session_remote_matches "$remote"; then
      if [[ "$type" == "x11" || "$type" == "wayland" ]]; then
        if [[ "$active" == "yes" && "$state" == "active" ]]; then
          echo "$name"
          return 0
        fi
        if [[ -z "$fallback_name" && ( "$state" == "active" || "$state" == "online" ) ]]; then
          fallback_name="$name"
        fi
      fi
    fi
  done < <(loginctl list-sessions --no-legend 2>/dev/null | awk '{print $1" "$2}')

  if [[ -n "$fallback_name" ]]; then
    echo "$fallback_name"
    return 0
  fi
  return 1
}

resolve_desktop_session_id() {
  local sid name type state active remote display
  local fallback_sid=""
  local fallback_display_sid=""

  if [[ -n "$FORCED_SESSION_ID" ]]; then
    sid="$FORCED_SESSION_ID"
    name="$(loginctl show-session "$sid" -p Name --value 2>/dev/null || true)"
    type="$(loginctl show-session "$sid" -p Type --value 2>/dev/null || true)"
    remote="$(loginctl show-session "$sid" -p Remote --value 2>/dev/null || true)"
    display="$(loginctl show-session "$sid" -p Display --value 2>/dev/null || true)"
    if [[ "$name" != "$TARGET_USER" ]]; then
      echo "[runas-remote] forced sid=$sid does not belong to $TARGET_USER" >&2
      return 1
    fi
    if [[ "$type" != "x11" && "$type" != "wayland" ]]; then
      echo "[runas-remote] forced sid=$sid is not graphical (type=$type)" >&2
      return 1
    fi
    if ! session_remote_matches "$remote"; then
      echo "[runas-remote] forced sid=$sid does not match remote filter ($SESSION_REMOTE_FILTER)" >&2
      return 1
    fi
    if [[ -n "$FORCED_DISPLAY" && "$display" != "$FORCED_DISPLAY" ]]; then
      echo "[runas-remote] forced sid=$sid has display=$display, expected $FORCED_DISPLAY" >&2
      return 1
    fi
    echo "$sid"
    return 0
  fi

  while read -r sid _; do
    [[ -n "$sid" ]] || continue
    name="$(loginctl show-session "$sid" -p Name --value 2>/dev/null || true)"
    type="$(loginctl show-session "$sid" -p Type --value 2>/dev/null || true)"
    state="$(loginctl show-session "$sid" -p State --value 2>/dev/null || true)"
    active="$(loginctl show-session "$sid" -p Active --value 2>/dev/null || true)"
    remote="$(loginctl show-session "$sid" -p Remote --value 2>/dev/null || true)"
    display="$(loginctl show-session "$sid" -p Display --value 2>/dev/null || true)"

    if [[ "$name" == "$TARGET_USER" ]] && session_remote_matches "$remote"; then
      if [[ "$type" == "x11" || "$type" == "wayland" ]]; then
        if [[ -n "$FORCED_DISPLAY" && "$display" != "$FORCED_DISPLAY" ]]; then
          continue
        fi
        if [[ "$active" == "yes" && "$state" == "active" ]]; then
          echo "$sid"
          return 0
        fi
        if [[ -z "$fallback_sid" && ( "$state" == "active" || "$state" == "online" ) ]]; then
          if [[ -n "$display" ]]; then
            fallback_display_sid="$sid"
          else
            fallback_sid="$sid"
          fi
        fi
      fi
    fi
  done < <(loginctl list-sessions --no-legend 2>/dev/null | awk '{print $1" "$2}')

  if [[ -n "$fallback_display_sid" ]]; then
    echo "$fallback_display_sid"
    return 0
  fi
  if [[ -n "$fallback_sid" ]]; then
    echo "$fallback_sid"
    return 0
  fi
  return 1
}

SESSION_REMOTE_FILTER="${RUNAS_REMOTE_SESSION_REMOTE:-any}"
FORCED_SESSION_ID="${RUNAS_REMOTE_SESSION_ID:-}"
FORCED_DISPLAY="${RUNAS_REMOTE_DISPLAY:-}"
session_remote_matches() {
  local remote="${1:-}"
  case "$SESSION_REMOTE_FILTER" in
    any|ANY) true ;;
    no|NO)
      remote="${remote,,}"
      [[ -z "$remote" || "$remote" == "no" || "$remote" == "-" || "$remote" == "unknown" ]]
      ;;
    yes|YES) [[ "${remote,,}" == "yes" ]] ;;
    *) true ;;
  esac
}

print_sessions() {
  local wanted_user="${1:-}"
  local sid name type state active remote display leader
  printf '%-5s %-12s %-8s %-8s %-7s %-7s %-8s %-8s\n' "SID" "USER" "TYPE" "STATE" "ACTIVE" "REMOTE" "DISPLAY" "LEADER"
  printf '%-5s %-12s %-8s %-8s %-7s %-7s %-8s %-8s\n' "-----" "------------" "--------" "--------" "-------" "-------" "--------" "--------"
  while read -r sid _; do
    [[ -n "$sid" ]] || continue
    name="$(loginctl show-session "$sid" -p Name --value 2>/dev/null || true)"
    type="$(loginctl show-session "$sid" -p Type --value 2>/dev/null || true)"
    state="$(loginctl show-session "$sid" -p State --value 2>/dev/null || true)"
    active="$(loginctl show-session "$sid" -p Active --value 2>/dev/null || true)"
    remote="$(loginctl show-session "$sid" -p Remote --value 2>/dev/null || true)"
    display="$(loginctl show-session "$sid" -p Display --value 2>/dev/null || true)"
    leader="$(loginctl show-session "$sid" -p Leader --value 2>/dev/null || true)"
    if [[ -n "$wanted_user" && "$name" != "$wanted_user" ]]; then
      continue
    fi
    printf '%-5s %-12s %-8s %-8s %-7s %-7s %-8s %-8s\n' \
      "${sid:-?}" "${name:-?}" "${type:-?}" "${state:-?}" "${active:-?}" "${remote:-?}" "${display:--}" "${leader:-?}"
  done < <(loginctl list-sessions --no-legend 2>/dev/null | awk '{print $1" "$2}')
}

if [[ "${1:-}" == "--list-sessions" ]]; then
  print_sessions "${2:-}"
  exit 0
fi

session_env_var() {
  local sid="$1"
  local key="$2"
  local leader

  leader="$(loginctl show-session "$sid" -p Leader --value 2>/dev/null || true)"
  [[ -n "$leader" && -r "/proc/$leader/environ" ]] || return 1

  tr '\0' '\n' < "/proc/$leader/environ" | awk -F= -v k="$key" '$1==k{print substr($0, length(k)+2); exit}'
}

append_extra_env_pair() {
  local key="$1"
  local val="$2"
  [[ -n "$key" ]] || return 0
  env_args+=("${key}=${val}")
}

load_extra_env_file() {
  local file="$1"
  local line key val
  [[ -f "$file" ]] || {
    echo "[runas-remote] env file not found: $file" >&2
    exit 1
  }

  while IFS= read -r line || [[ -n "$line" ]]; do
    [[ -n "$line" ]] || continue
    [[ "$line" == \#* ]] && continue
    if [[ "$line" != *=* ]]; then
      echo "[runas-remote] invalid env line (missing '='): $line" >&2
      exit 1
    fi
    key="${line%%=*}"
    val="${line#*=}"
    if [[ ! "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
      echo "[runas-remote] invalid env key in file: $key" >&2
      exit 1
    fi
    append_extra_env_pair "$key" "$val"
  done < "$file"
}

load_extra_env_passthrough() {
  local names_raw="$1"
  local name
  names_raw="${names_raw//,/ }"
  for name in $names_raw; do
    [[ "$name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || {
      echo "[runas-remote] invalid passthrough env name: $name" >&2
      exit 1
    }
    if [[ -v "$name" ]]; then
      append_extra_env_pair "$name" "${!name}"
    fi
  done
}

DEFAULT_USER="${WBEAM_DEV_REMOTE_USER:-}"
DEFAULT_APP="./desktop.sh"

if [[ -z "$DEFAULT_USER" ]]; then
  DEFAULT_USER="$(resolve_active_user_from_loginctl || true)"
fi

if [[ $# -eq 0 ]]; then
  if [[ -z "$DEFAULT_USER" ]]; then
    echo "[runas-remote] default user not found. Provide <desktop_user> or set WBEAM_DEV_REMOTE_USER." >&2
    exit 1
  fi
  TARGET_USER="$DEFAULT_USER"
  APP_SPEC="$DEFAULT_APP"
  set --
elif [[ $# -eq 1 ]]; then
  if user_exists "$1"; then
    TARGET_USER="$1"
    APP_SPEC="$DEFAULT_APP"
  else
    if [[ -z "$DEFAULT_USER" ]]; then
      echo "[runas-remote] default user not found. Provide <desktop_user> or set WBEAM_DEV_REMOTE_USER." >&2
      exit 1
    fi
    TARGET_USER="$DEFAULT_USER"
    APP_SPEC="$1"
  fi
  set --
else
  # Normal mode: user first, app second.
  if user_exists "$1"; then
    TARGET_USER="$1"
    APP_SPEC="$2"
    shift 2
    if [[ "${1:-}" == "--" ]]; then
      shift
    fi
  # Compatibility mode for common typo: app first, user second.
  elif user_exists "$2"; then
    TARGET_USER="$2"
    APP_SPEC="$1"
    shift 2
    if [[ "${1:-}" == "--" ]]; then
      shift
    fi
    echo "[runas-remote] WARN: detected app-first argument order; expected: <user> <app>." >&2
  else
    usage >&2
    exit 1
  fi
fi

if ! id "$TARGET_USER" >/dev/null 2>&1; then
  echo "[runas-remote] user not found: $TARGET_USER" >&2
  exit 1
fi

if [[ "$APP_SPEC" == */* ]]; then
  if [[ "$APP_SPEC" != /* ]]; then
    TARGET_SCRIPT="$PWD/$APP_SPEC"
  else
    TARGET_SCRIPT="$APP_SPEC"
  fi
elif [[ "$APP_SPEC" == "desktop" ]]; then
  echo "[runas-remote] 'desktop' target alias was removed." >&2
  echo "[runas-remote] run desktop launcher directly, e.g.: ./runas-remote $TARGET_USER ./desktop.sh" >&2
  exit 1
elif [[ -x "$ROOT_DIR/$APP_SPEC" ]]; then
  TARGET_SCRIPT="$ROOT_DIR/$APP_SPEC"
elif [[ -x "$PWD/$APP_SPEC" ]]; then
  TARGET_SCRIPT="$PWD/$APP_SPEC"
elif command -v "$APP_SPEC" >/dev/null 2>&1; then
  TARGET_SCRIPT="$APP_SPEC"
else
  echo "[runas-remote] app/script not found: $APP_SPEC" >&2
  echo "[runas-remote] pass an executable path or command name." >&2
  exit 1
fi

if [[ "$TARGET_SCRIPT" == */* && ! -x "$TARGET_SCRIPT" ]]; then
  echo "[runas-remote] missing or not executable: $TARGET_SCRIPT" >&2
  exit 1
fi

TARGET_UID="$(id -u "$TARGET_USER")"
TARGET_HOME="$(getent passwd "$TARGET_USER" | cut -d: -f6)"
XDG_RUNTIME_DIR="/run/user/$TARGET_UID"

if ! SESSION_ID="$(resolve_desktop_session_id)"; then
  if [[ -n "$FORCED_DISPLAY" ]]; then
    SESSION_ID="manual"
    SESSION_TYPE="x11"
    DISPLAY_VAL="$FORCED_DISPLAY"
  else
    for sock in /tmp/.X11-unix/X*; do
      [[ -S "$sock" ]] || continue
      SESSION_ID="manual"
      SESSION_TYPE="x11"
      DISPLAY_VAL=":${sock##*X}"
      echo "[runas-remote] WARN: no loginctl graphical session for $TARGET_USER; falling back to DISPLAY=$DISPLAY_VAL" >&2
      break
    done
    if [[ -z "${SESSION_ID:-}" ]]; then
      echo "[runas-remote] could not detect a graphical session for $TARGET_USER." >&2
      exit 1
    fi
  fi
fi

if [[ "${SESSION_TYPE:-}" == "" ]]; then
  SESSION_TYPE="$(loginctl show-session "$SESSION_ID" -p Type --value 2>/dev/null || true)"
  [[ -n "$SESSION_TYPE" ]] || SESSION_TYPE="wayland"
fi

DISPLAY_VAL="${DISPLAY_VAL:-${FORCED_DISPLAY:-}}"
if [[ -z "$DISPLAY_VAL" ]]; then
  DISPLAY_VAL="$(loginctl show-session "$SESSION_ID" -p Display --value 2>/dev/null || true)"
fi
if [[ -z "$DISPLAY_VAL" ]]; then
  DISPLAY_VAL="$(session_env_var "$SESSION_ID" DISPLAY || true)"
fi
if [[ -z "$DISPLAY_VAL" && "$SESSION_TYPE" == "x11" ]]; then
  for sock in /tmp/.X11-unix/X*; do
    [[ -S "$sock" ]] || continue
    DISPLAY_VAL=":${sock##*X}"
    break
  done
fi
[[ -n "$DISPLAY_VAL" ]] || DISPLAY_VAL=":0"

WAYLAND_DISPLAY_VAL=""
if [[ "$SESSION_TYPE" == "wayland" ]]; then
  for wsock in "$XDG_RUNTIME_DIR"/wayland-*; do
    [[ -S "$wsock" ]] || continue
    WAYLAND_DISPLAY_VAL="$(basename "$wsock")"
    break
  done
  [[ -n "$WAYLAND_DISPLAY_VAL" ]] || WAYLAND_DISPLAY_VAL="wayland-0"
fi

DBUS_ADDR="unix:path=$XDG_RUNTIME_DIR/bus"
XAUTHORITY_VAL="${TARGET_HOME:-/home/$TARGET_USER}/.Xauthority"
if [[ "$SESSION_TYPE" == "x11" ]]; then
  XAUTHORITY_VAL="$(session_env_var "$SESSION_ID" XAUTHORITY || true)"
  if [[ -z "$XAUTHORITY_VAL" || ! -f "$XAUTHORITY_VAL" ]]; then
    if [[ -n "${TARGET_HOME:-}" && -f "${TARGET_HOME}/.Xauthority" ]]; then
      XAUTHORITY_VAL="${TARGET_HOME}/.Xauthority"
    fi
  fi
  if [[ -z "$XAUTHORITY_VAL" || ! -f "$XAUTHORITY_VAL" ]]; then
    for xa in "$XDG_RUNTIME_DIR"/xauth_*; do
      [[ -f "$xa" ]] || continue
      XAUTHORITY_VAL="$xa"
      break
    done
  fi
  [[ -n "$XAUTHORITY_VAL" ]] || XAUTHORITY_VAL="${TARGET_HOME:-/home/$TARGET_USER}/.Xauthority"
fi

env_args=(
  "XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR"
  "DBUS_SESSION_BUS_ADDRESS=$DBUS_ADDR"
)

# Force session identity for child processes (daemon/UI). Without this override,
# a parent shell exported as tty can leak into target process and break host probe.
if [[ -n "$SESSION_TYPE" ]]; then
  env_args+=("XDG_SESSION_TYPE=$SESSION_TYPE")
fi

SESSION_DESKTOP_VAL="$(session_env_var "$SESSION_ID" XDG_CURRENT_DESKTOP || true)"
if [[ -z "$SESSION_DESKTOP_VAL" ]]; then
  SESSION_DESKTOP_VAL="$(session_env_var "$SESSION_ID" DESKTOP_SESSION || true)"
fi
if [[ -n "$SESSION_DESKTOP_VAL" ]]; then
  env_args+=("XDG_CURRENT_DESKTOP=$SESSION_DESKTOP_VAL")
  env_args+=("DESKTOP_SESSION=$SESSION_DESKTOP_VAL")
fi

if [[ -n "${RUNAS_REMOTE_PASSTHROUGH_ENV:-}" ]]; then
  load_extra_env_passthrough "${RUNAS_REMOTE_PASSTHROUGH_ENV}"
fi
if [[ -n "${RUNAS_REMOTE_ENV_FILE:-}" ]]; then
  load_extra_env_file "${RUNAS_REMOTE_ENV_FILE}"
fi

if [[ -n "$DISPLAY_VAL" ]]; then
  env_args+=("DISPLAY=$DISPLAY_VAL")
fi

if [[ "$SESSION_TYPE" == "x11" && -f "$XAUTHORITY_VAL" ]]; then
  env_args+=("XAUTHORITY=$XAUTHORITY_VAL")
fi

if [[ "$SESSION_TYPE" == "wayland" ]]; then
  env_args+=("WAYLAND_DISPLAY=$WAYLAND_DISPLAY_VAL")
fi

if [[ "${RUNAS_REMOTE_QUIET:-0}" != "1" ]]; then
  echo "[runas-remote] uid=$TARGET_UID sid=$SESSION_ID session=$SESSION_TYPE display=$DISPLAY_VAL app=$APP_SPEC"
fi

exec sudo -u "$TARGET_USER" env "${env_args[@]}" "$TARGET_SCRIPT" "$@"