#!/bin/bash
set -e

# ccc-statusd installation script
# Downloads and decrypts the latest release from Cloudflare R2

VERSION="${VERSION:-latest}"
R2_BASE_URL="https://get-ucc.sui.pics"
INSTALL_DIR="${INSTALL_DIR:-$HOME/.local/bin}"

# ENCRYPTION_PASSWORD must be provided via environment variable
if [ -z "$ENCRYPTION_PASSWORD" ]; then
    echo "Error: ENCRYPTION_PASSWORD environment variable is required." >&2
    echo "Usage: curl -fsSL https://get-ucc.sui.pics/ | ENCRYPTION_PASSWORD=your_password bash" >&2
    exit 1
fi

# Color output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

info() {
    echo -e "${GREEN}==>${NC} $1"
}

warn() {
    echo -e "${YELLOW}Warning:${NC} $1"
}

error() {
    echo -e "${RED}Error:${NC} $1" >&2
    exit 1
}

# Check for required commands
check_command() {
    if ! command -v "$1" &> /dev/null; then
        error "$1 is required but not installed. Please install it and try again."
    fi
}

# Detect platform and architecture
detect_platform() {
    local os arch

    os=$(uname -s | tr '[:upper:]' '[:lower:]')
    case "$os" in
        linux) os="linux" ;;
        darwin) os="darwin" ;;
        *) error "Unsupported operating system: $os" ;;
    esac

    arch=$(uname -m)
    case "$arch" in
        x86_64|amd64) arch="amd64" ;;
        aarch64|arm64) arch="arm64" ;;
        *) error "Unsupported architecture: $arch" ;;
    esac

    echo "${os}-${arch}"
}

# Main installation
main() {
    info "ccc-statusd installer"
    echo

    # Check dependencies
    check_command curl
    check_command openssl

    # Detect platform
    PLATFORM=$(detect_platform)
    info "Detected platform: $PLATFORM"

    # Determine binary name
    BINARY_NAME="ccc-statusd-${PLATFORM}"
    ENCRYPTED_FILE="${BINARY_NAME}.enc"
    DOWNLOAD_URL="${R2_BASE_URL}/releases/${VERSION}/${ENCRYPTED_FILE}"

    info "Downloading from: $DOWNLOAD_URL"

    # Create temp directory
    TMP_DIR=$(mktemp -d)
    trap "rm -rf $TMP_DIR" EXIT

    # Download encrypted binary
    if ! curl -fsSL "$DOWNLOAD_URL" -o "$TMP_DIR/$ENCRYPTED_FILE"; then
        error "Failed to download binary from $DOWNLOAD_URL"
    fi

    info "Decrypting binary..."
    if ! openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 \
        -in "$TMP_DIR/$ENCRYPTED_FILE" \
        -out "$TMP_DIR/ccc-statusd" \
        -pass pass:"${ENCRYPTION_PASSWORD}" 2>/dev/null; then
        error "Failed to decrypt binary. The file may be corrupted."
    fi

    # Create install directory if it doesn't exist
    mkdir -p "$INSTALL_DIR"

    # Stop running daemon if exists
    if [ -f "$INSTALL_DIR/ccc-statusd" ]; then
        info "Stopping running daemon..."
        "$INSTALL_DIR/ccc-statusd" stop 2>/dev/null || true
    fi

    # Install binary
    info "Installing to $INSTALL_DIR/ccc-statusd..."
    mv "$TMP_DIR/ccc-statusd" "$INSTALL_DIR/ccc-statusd"
    chmod +x "$INSTALL_DIR/ccc-statusd"

    # Remove macOS quarantine attribute if on macOS
    if [ "$(uname -s)" = "Darwin" ]; then
        xattr -d com.apple.quarantine "$INSTALL_DIR/ccc-statusd" 2>/dev/null || true
    fi

    info "Installation complete!"
    echo
    info "Next steps:"
    echo "  1. Ensure $INSTALL_DIR is in your PATH"
    echo "  2. Run: ccc-statusd hook install"
    echo "  3. Run: ccc-statusd start"
    echo
    info "Version installed:"
    "$INSTALL_DIR/ccc-statusd" --version || true
}

main "$@"