#!/bin/bash
# Manual staff command for permanently erasing the team account's files.
# Stops the desktop, deletes the home and team-owned files on the root
# filesystem, then recreates the home. No backup or undo.
# Never invoke from boot, login, a timer, cron, a playbook or automated tests.
# Run only after explicit staff authorization and verified backups.
# The --now argument is internal to the transient service after confirmation.
set -u
[ "$(id -u)" -eq 0 ] || { echo "Run this script as root (sudo)." >&2; exit 1; }
if [ "${1:-}" != --now ]; then
    echo "The files of the team account will be deleted on this machine."
    read -rp "Type RESET to continue: " answer
    [ "$answer" = RESET ] || { echo "Cancelled."; exit 1; }
    # The reset ends the desktop session, and with it this terminal if the
    # script was started from the desktop. It runs as a separate service.
    systemd-run --unit=reset-team-home --collect --quiet "$(readlink -f "$0")" --now
    echo "Reset started. The screen restarts in a few seconds."
    exit 0
fi

systemctl stop lightdm
loginctl terminate-user team 2>/dev/null
sleep 2
pkill -KILL -u team 2>/dev/null
sleep 1
for m in /home/team/.vscode/extensions /home/team/.vscode/extensions-root; do
    umount "$m" 2>/dev/null
done
rm -rf --one-file-system /home/team
find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -user team -print0 2>/dev/null \
    | xargs -0 -r rm -rf --one-file-system
mkdir /home/team
cp -a /etc/skel/. /home/team/
chown -R team:teams /home/team
chmod 750 /home/team
systemctl restart team-vscode-extensions.service
systemctl start lightdm
echo "The team account is clean."