#!/bin/bash
set -euo pipefail

# ── Defaults ─────────────────────────────────────────────────────────
DEFAULT_LENGTH=16
CHARSET="alnum"  # alnum | ascii

# ── Usage ────────────────────────────────────────────────────────────
usage() {
    cat <<EOF
Usage: $(basename "$0") [OPTIONS] [LENGTH]

Generate a random password of the given length (default: ${DEFAULT_LENGTH}).

Options:
    -h, --help      Show this help
    -s, --special    Include special characters (!@#\$%^&*_+-=)
    -c, --copy       Copy password to clipboard (requires wl-copy)

Examples:
    $(basename "$0")             # 16-char alphanumeric password
    $(basename "$0") 32          # 32-char alphanumeric password
    $(basename "$0") -s 24       # 24-char password with special characters
    $(basename "$0") -sc 20      # 20-char with specials, copied to clipboard
EOF
    exit 1
}

# ── Parse arguments ──────────────────────────────────────────────────
FLAG_COPY=""

while (( $# )); do
    case "$1" in
        -h|--help)     usage ;;
        -s|--special)  CHARSET="ascii"; shift ;;
        -c|--copy)     FLAG_COPY=1; shift ;;
        -sc|-cs)       CHARSET="ascii"; FLAG_COPY=1; shift ;;
        -*)            echo "Unknown option: $1" >&2; usage ;;
        *)             break ;;
    esac
done

LENGTH="${1:-$DEFAULT_LENGTH}"

# ── Validate length ─────────────────────────────────────────────────
if ! [[ "$LENGTH" =~ ^[0-9]+$ ]] || (( LENGTH <= 0 )); then
    echo "Error: length must be a positive integer, got '${LENGTH}'" >&2
    exit 1
fi

# ── Generate password ───────────────────────────────────────────────
# tr character classes:
#   alnum  -> [A-Za-z0-9]
#   ascii  -> [A-Za-z0-9] + special characters
generate_password() {
    local len="$1"
    local filter

    case "$CHARSET" in
        alnum) filter='A-Za-z0-9' ;;
        ascii) filter='A-Za-z0-9!@#$%^&*_+\-=' ;;
    esac

    # Read enough random bytes to guarantee the desired length after filtering.
    # tr may exit with SIGPIPE once head has enough bytes — that is expected.
    LC_ALL=C tr -dc "$filter" </dev/urandom | head -c "$len" || true
}

PASSWORD="$(generate_password "$LENGTH")"

# ── Output ───────────────────────────────────────────────────────────
echo "$PASSWORD"

# ── Copy to clipboard ───────────────────────────────────────────────
if [[ -n "$FLAG_COPY" ]]; then
    if command -v wl-copy &>/dev/null; then
        echo -n "$PASSWORD" | wl-copy
        echo "(copied to clipboard)" >&2
    else
        echo "Warning: wl-copy not found (install wl-clipboard)" >&2
    fi
fi