#!/usr/bin/env bash
# ──────────────────────────────────────────────────────────────────────────────
#  Argos Agent — one-command installer
#
#  Downloads the signed agent bundle from the Argos distribution host,
#  verifies its SHA-256, extracts it to a temp dir, and runs the right
#  platform installer with whatever flags you passed through.
#
#  Usage
#    Interactive    :  curl -fsSL https://argosdev.vercel.app/install.sh \
#                        | sudo bash
#    Unattended     :  curl -fsSL https://argosdev.vercel.app/install.sh \
#                        | sudo bash -s -- \
#                          --bootstrap argos_bs_<CODE>             \
#                          --server-url https://argos.<org>:9090   \
#                          --user alice@<org>.com                  \
#                          --department Engineering                \
#                          --non-interactive
#
#  Inspect before running (recommended for first install)
#    curl -fsSL https://argosdev.vercel.app/install.sh -o install.sh
#    less install.sh
#    sudo bash install.sh --bootstrap …
#
#  Env overrides (TESTING ONLY)
#    ARGOS_BASE_URL       distribution host (default https://argosdev.vercel.app)
#    ARGOS_SKIP_SHA       skip checksum verification (DON'T in production)
#    ARGOS_KEEP_TMP       leave the extracted tree in place for inspection
#
#  OWASP controls
#    A01  refuses to run as non-root (services need root to install)
#    A02  all downloads over TLS via curl --fail-with-body
#    A06  SHA-256 of zip is verified against a sidecar file SHA256SUMS
#         served from the same host; mismatch aborts before extraction
#    A04  fail-closed: any error triggers cleanup of the temp dir; the
#         platform installer's own trap handles its rollback
#    A09  install log preserved by the platform installer
# ──────────────────────────────────────────────────────────────────────────────
set -Eeuo pipefail
IFS=$'\n\t'
umask 077

BASE_URL="${ARGOS_BASE_URL:-https://argos.tail3ad60e.ts.net}"
ZIP_NAME="argos-client.zip"
SHA_NAME="SHA256SUMS"

if [[ -t 1 ]]; then
  GREEN=$'\033[0;32m'; YELLOW=$'\033[0;33m'; RED=$'\033[0;31m'
  CYAN=$'\033[0;36m'; BOLD=$'\033[1m'; NC=$'\033[0m'
else
  GREEN=''; YELLOW=''; RED=''; CYAN=''; BOLD=''; NC=''
fi
log()  { printf '  %s✓%s %s\n' "$GREEN" "$NC" "$1"; }
warn() { printf '  %s⚠%s %s\n' "$YELLOW" "$NC" "$1"; }
info() { printf '  %s→%s %s\n' "$CYAN" "$NC" "$1"; }
fail() { printf '  %s✗%s %s\n' "$RED" "$NC" "$1" >&2; exit 1; }

TMP_DIR=""
_cleanup() {
  local rc=$?
  if [[ -n "$TMP_DIR" && -d "$TMP_DIR" ]]; then
    if [[ -n "${ARGOS_KEEP_TMP:-}" && $rc -ne 0 ]]; then
      warn "left temp tree at $TMP_DIR (ARGOS_KEEP_TMP)"
    else
      rm -rf "$TMP_DIR"
    fi
  fi
  exit $rc
}
trap _cleanup EXIT
trap 'echo; fail "interrupted"' INT TERM

printf '%s\n' "$BOLD"
cat <<'B'
  ╔════════════════════════════════════════════════╗
  ║   Argos Agent — one-command installer          ║
  ╚════════════════════════════════════════════════╝
B
printf '%s\n' "$NC"

# A01 — privilege check
[[ "$EUID" -eq 0 ]] || fail "must be run as root (try: curl … | sudo bash)"

# Prereqs
for cmd in curl unzip uname mktemp; do
  command -v "$cmd" >/dev/null || fail "missing required tool: $cmd"
done
# SHA-256 — Linux has sha256sum, macOS has shasum -a 256
SHA_CMD=""
if command -v sha256sum >/dev/null;  then SHA_CMD="sha256sum"
elif command -v shasum    >/dev/null; then SHA_CMD="shasum -a 256"
else fail "neither sha256sum nor shasum is available"
fi

# Platform detection
case "$(uname -s)" in
  Linux)  PLATFORM=linux ;;
  Darwin) PLATFORM=macos ;;
  *)      fail "unsupported OS: $(uname -s) (Linux/macOS only; Windows users run installer/windows/install.ps1)" ;;
esac
info "platform: $PLATFORM"

# Working directory
TMP_DIR="$(mktemp -d -t argos-install.XXXXXX)"
info "staging at $TMP_DIR"

# Download zip + checksum file
info "downloading $BASE_URL/$ZIP_NAME"
curl --fail-with-body --silent --show-error --location \
     --max-time 120 \
     -o "$TMP_DIR/$ZIP_NAME" \
     "$BASE_URL/$ZIP_NAME" \
  || fail "download failed (check $BASE_URL is reachable)"
log "$(printf '%6s KB · %s' "$(($(wc -c < "$TMP_DIR/$ZIP_NAME")/1024))" "$ZIP_NAME")"

if [[ -z "${ARGOS_SKIP_SHA:-}" ]]; then
  info "downloading $BASE_URL/$SHA_NAME"
  curl --fail-with-body --silent --show-error --location \
       --max-time 30 \
       -o "$TMP_DIR/$SHA_NAME" \
       "$BASE_URL/$SHA_NAME" \
    || fail "could not fetch checksum file (set ARGOS_SKIP_SHA=1 only if you know what you're doing)"

  EXPECTED="$(awk -v n="$ZIP_NAME" '$2==n || $2=="*"n { print $1 }' "$TMP_DIR/$SHA_NAME" | head -1)"
  [[ -n "$EXPECTED" ]] || fail "$ZIP_NAME not listed in $SHA_NAME"

  COMPUTED="$($SHA_CMD "$TMP_DIR/$ZIP_NAME" | awk '{print $1}')"
  if [[ "$COMPUTED" != "$EXPECTED" ]]; then
    fail "checksum mismatch — expected $EXPECTED, got $COMPUTED. Don't trust this zip."
  fi
  log "checksum verified · $EXPECTED"
else
  warn "ARGOS_SKIP_SHA set — skipping checksum verification"
fi

# Extract
info "extracting"
unzip -q "$TMP_DIR/$ZIP_NAME" -d "$TMP_DIR"
[[ -d "$TMP_DIR/argos-client/client/installer/$PLATFORM" ]] \
  || fail "bundle layout unexpected (missing client/installer/$PLATFORM/)"

INSTALLER="$TMP_DIR/argos-client/client/installer/$PLATFORM/install.sh"
[[ -x "$INSTALLER" ]] || chmod +x "$INSTALLER"

# Hand off
info "running platform installer with: $*"
echo
exec "$INSTALLER" "$@"