#!/usr/bin/env bash
set -euo pipefail

# Public download bootstrap; the installer INSIDE the verified ZIP owns all
# host detection, upgrades, data preservation and dynamic Dashboard discovery.
# The override is also used for local HTTP-mirror acceptance, not public E2E.
release_base="${OPENFANS_RELEASE_BASE_URL:-https://openfans-installer-pages.pages.dev}"
release_base="${release_base%/}"
case "$release_base" in
  https://*|http://127.0.0.1:[0-9]*) ;;
  *) echo 'OpenFans requires an HTTPS release origin.' >&2; exit 1 ;;
esac
if [[ "$(uname -s)" != Darwin ]]; then
  echo 'OpenFans currently requires macOS.' >&2
  exit 1
fi
for command_name in curl shasum unzip stat awk tee; do
  command -v "$command_name" >/dev/null 2>&1 || { echo "OpenFans requires $command_name." >&2; exit 1; }
done
[[ -x /usr/bin/plutil ]] || { echo 'OpenFans requires macOS plutil.' >&2; exit 1; }

download_dir="$(mktemp -d "${TMPDIR:-/tmp}/openfans-install.XXXXXX")"
cleanup() {
  local status=$?
  # Only this invocation's exact mktemp directory is disposable.
  if [[ -n "$download_dir" && -d "$download_dir" ]]; then /bin/rm -rf "$download_dir"; fi
  if (( status != 0 )); then echo "OPENFANS_BOOTSTRAP_RESULT=FAILED exit_code=$status" >&2; fi
}
trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
manifest_path="$download_dir/latest.json"
package_path="$download_dir/openfans.zip"
echo 'Checking the latest OpenFans release...'
curl --fail --location --retry 3 --retry-delay 2 --connect-timeout 20 --max-time 120 \
  --output "$manifest_path" "$release_base/latest.json"
read_manifest_value() { /usr/bin/plutil -extract "$1" raw -o - "$manifest_path"; }
version="$(read_manifest_value version)"
build_id="$(read_manifest_value build_id)"
package_name="$(read_manifest_value package_name)"
package_url="$(read_manifest_value package_url)"
package_sha256="$(read_manifest_value sha256)"
package_size="$(read_manifest_value package_size)"
if [[ ! "$version" =~ ^[0-9]+(\.[0-9]+)+$ || ! "$package_name" =~ ^OPENFANS-[A-Za-z0-9._-]+\.zip$ \
   || ! "$build_id" =~ ^[0-9]{8}-[0-9]{6}$ \
   || ! "$package_sha256" =~ ^[0-9a-f]{64}$ || ! "$package_size" =~ ^[1-9][0-9]{0,9}$ ]]; then
  echo 'The OpenFans release manifest is invalid. Installation stopped safely.' >&2; exit 1
fi
if [[ "$package_name" != "OPENFANS-V$version-MAC-$build_id.zip" \
   || "$package_url" != "$release_base/releases/$version/$package_name" ]] || (( package_size >= 1200000000 )); then
  echo 'The OpenFans package origin, name or size is invalid. Installation stopped safely.' >&2; exit 1
fi
echo "Downloading OpenFans V$version ($package_name)..."
curl --fail --location --retry 3 --retry-delay 2 --connect-timeout 20 --max-time 2700 \
  --output "$package_path" "$package_url"
actual_size="$(stat -f '%z' "$package_path")"
[[ "$actual_size" == "$package_size" ]] || { echo 'OpenFans download size verification failed.' >&2; exit 1; }
actual_sha256="$(shasum -a 256 "$package_path" | awk '{print $1}')"
[[ "$actual_sha256" == "$package_sha256" ]] || { echo 'OpenFans download SHA-256 verification failed.' >&2; exit 1; }
unzip -tq "$package_path"

# Consume the complete listing: an early awk exit under pipefail used to
# abort larger releases with SIGPIPE/141 after downloading 100%.
package_root="OPENFANS-V$version-ALL-AGENT"
unzip -Z1 "$package_path" > "$download_dir/entries.txt"
if ! awk -v root="$package_root" '
  index($0, root "/") != 1 || $0 ~ /(^|\/)\.\.(\/|$)/ || $0 ~ /\\/ { invalid=1 }
  END { exit NR > 0 && !invalid ? 0 : 1 }
' "$download_dir/entries.txt"; then
  echo 'OpenFans archive has unsafe paths or an unexpected root.' >&2; exit 1
fi
if ! unzip -Z -l "$package_path" | awk 'substr($1,1,1)=="l" { invalid=1 } END { exit invalid ? 1 : 0 }'; then
  echo 'OpenFans archive contains a symbolic link.' >&2; exit 1
fi
unzip -q "$package_path" -d "$download_dir"
installer_path="$download_dir/$package_root/install.sh"
[[ -f "$installer_path" && ! -L "$installer_path" ]] || { echo 'OpenFans package installer is missing.' >&2; exit 1; }
identity_path="$download_dir/$package_root/version.json"
[[ -f "$identity_path" && ! -L "$identity_path" ]] || { echo 'OpenFans package identity is missing.' >&2; exit 1; }
[[ "$(/usr/bin/plutil -extract version raw -o - "$identity_path")" == "$version" \
   && "$(/usr/bin/plutil -extract buildId raw -o - "$identity_path")" == "$build_id" ]] \
  || { echo 'OpenFans package identity does not match the release manifest.' >&2; exit 1; }
installer_args=("$@")
if (( $# == 0 )); then installer_args=(--target auto); fi
echo "OpenFans V$version verified: SHA-256 $actual_sha256"
if ! /bin/bash "$installer_path" "${installer_args[@]}" | tee "$download_dir/install.log"; then
  echo 'OpenFans package installation did not finish successfully.' >&2; exit 1
fi
if ! awk '/^OPENFANS_INSTALL_RESULT=READY([[:space:]]|$)/ { ready=1 } END { exit ready ? 0 : 1 }' "$download_dir/install.log"; then
  echo 'OpenFans package installer did not return terminal READY.' >&2; exit 1
fi
echo "OPENFANS_BOOTSTRAP_RESULT=READY version=$version sha256=$actual_sha256"