#!/bin/bash
set -euo pipefail

# install.sh — Install the S7 CLI and optionally run striker install
# Usage:
#   Install CLI only:     curl -sL https://get.strike7.ai | bash
#   Install + striker:    curl -sL https://get.strike7.ai | bash -s -- --token <TOKEN>

S3_BUCKET="s7-cli-releases"
S3_REGION="us-east-1"
INSTALL_DIR="/usr/local/bin"
BINARY="s7"

_tmp=""
trap '[ -n "$_tmp" ] && rm -rf "$_tmp"' EXIT

main() {
    local os arch url token=""

    # Parse --token flag
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --token) token="$2"; shift 2 ;;
            *) shift ;;
        esac
    done

    os=$(uname -s | tr '[:upper:]' '[:lower:]')
    arch=$(uname -m)

    case "$arch" in
        x86_64|amd64) arch="amd64" ;;
        aarch64|arm64) arch="arm64" ;;
        *) echo "Unsupported architecture: $arch" >&2; exit 1 ;;
    esac

    case "$os" in
        linux|darwin) ;;
        *) echo "Unsupported OS: $os" >&2; exit 1 ;;
    esac

    echo "==> Detecting platform: ${os}/${arch}"

    url="https://${S3_BUCKET}.s3.${S3_REGION}.amazonaws.com/latest/s7_${os}_${arch}"
    _tmp=$(mktemp -d)

    if command -v s7 &>/dev/null; then
        echo "==> Updating S7 CLI ($(s7 version 2>/dev/null | head -1 || echo 'unknown'))..."
    else
        echo "==> Downloading S7 CLI..."
    fi

    curl -sL "$url" -o "${_tmp}/${BINARY}"

    # SHA256 checksum verification
    if curl -sLf "${url}.sha256" -o "${_tmp}/${BINARY}.sha256" 2>/dev/null; then
        echo "==> Verifying checksum..."
        # Extract just the hash (first field) — checksum file may reference
        # the platform-specific name (s7_darwin_arm64) not the local name (s7)
        expected_hash=$(awk '{print $1}' "${_tmp}/${BINARY}.sha256")
        if command -v sha256sum &>/dev/null; then
            actual_hash=$(sha256sum "${_tmp}/${BINARY}" | awk '{print $1}')
        elif command -v shasum &>/dev/null; then
            actual_hash=$(shasum -a 256 "${_tmp}/${BINARY}" | awk '{print $1}')
        else
            echo "==> Warning: no sha256sum or shasum found, skipping verification"
            actual_hash="$expected_hash"  # skip check
        fi
        if [ "$actual_hash" != "$expected_hash" ]; then
            echo "ERROR: Binary verification failed — possible tampering" >&2
            echo "  Expected: $expected_hash" >&2
            echo "  Got:      $actual_hash" >&2
            exit 1
        fi
        echo "==> Checksum OK"
    else
        echo "==> Warning: checksum not available, skipping verification"
    fi

    chmod +x "${_tmp}/${BINARY}"

    echo "==> Installing to ${INSTALL_DIR}/${BINARY}..."
    if [ -w "$INSTALL_DIR" ]; then
        mv "${_tmp}/${BINARY}" "${INSTALL_DIR}/${BINARY}"
    else
        sudo mv "${_tmp}/${BINARY}" "${INSTALL_DIR}/${BINARY}"
    fi

    echo "==> S7 CLI installed ($(s7 version 2>/dev/null | head -1 || echo 'done'))"

    # If token provided, run striker install
    if [ -n "$token" ]; then
        echo ""
        echo "==> Installing Striker..."
        s7 striker install --token "$token" </dev/null
    else
        echo ""
        echo "Run 's7 --help' to get started."
    fi
}

main "$@"