#!/bin/bash
#
# Cryptek Installer
# https://hperez.dev/cryptek
#
# Usage: curl -sSL https://hperez.dev/cryptek/install.sh | bash
#
# This script downloads and installs the latest version of Cryptek
# for your operating system and architecture.
#

set -e

VERSION="0.15.0"
BASE_URL="https://hperez.dev/downloads/cryptek/v${VERSION}"
INSTALL_DIR="${HOME}/.local/bin"

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

print_error() {
    echo -e "${RED}ERROR:${NC} $1" >&2
}

print_success() {
    echo -e "${GREEN}✓${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}WARNING:${NC} $1"
}

# Detect operating system
detect_os() {
    local os
    os=$(uname -s | tr '[:upper:]' '[:lower:]')

    case "$os" in
        linux)   echo "linux" ;;
        darwin)  echo "darwin" ;;
        mingw*|msys*|cygwin*)
            print_error "Windows is not supported by this installer."
            echo "Please download the Windows binary directly from:"
            echo "  ${BASE_URL}/cryptek_windows_amd64.zip"
            exit 1
            ;;
        *)
            print_error "Unsupported operating system: $os"
            exit 1
            ;;
    esac
}

# Detect architecture
detect_arch() {
    local arch
    arch=$(uname -m)

    case "$arch" in
        x86_64|amd64)    echo "amd64" ;;
        aarch64|arm64)   echo "arm64" ;;
        *)
            print_error "Unsupported architecture: $arch"
            exit 1
            ;;
    esac
}

# Check if curl or wget is available
get_downloader() {
    if command -v curl &> /dev/null; then
        echo "curl"
    elif command -v wget &> /dev/null; then
        echo "wget"
    else
        print_error "Neither curl nor wget is installed."
        echo "Please install curl or wget and try again."
        exit 1
    fi
}

# Download file using curl or wget
download() {
    local url="$1"
    local output="$2"
    local downloader
    downloader=$(get_downloader)

    if [ "$downloader" = "curl" ]; then
        curl -fsSL "$url" -o "$output"
    else
        wget -q "$url" -O "$output"
    fi
}

# Verify checksum
verify_checksum() {
    local file="$1"
    local expected_hash="$2"
    local actual_hash

    if command -v sha256sum &> /dev/null; then
        actual_hash=$(sha256sum "$file" | awk '{print $1}')
    elif command -v shasum &> /dev/null; then
        actual_hash=$(shasum -a 256 "$file" | awk '{print $1}')
    else
        print_error "Cannot verify checksum: neither sha256sum nor shasum is installed."
        echo "Refusing to install an unverified binary. Install one of those tools"
        echo "and re-run, or verify manually against:"
        echo "  ${BASE_URL}/checksums.txt"
        return 1
    fi

    if [ "$actual_hash" != "$expected_hash" ]; then
        print_error "Checksum verification failed!"
        echo "Expected: $expected_hash"
        echo "Got:      $actual_hash"
        return 1
    fi

    return 0
}

# Main installation
main() {
    echo "Cryptek Installer v${VERSION}"
    echo "=============================="
    echo

    # Detect system
    local os arch filename
    os=$(detect_os)
    arch=$(detect_arch)
    filename="cryptek_${os}_${arch}.tar.gz"

    echo "Detected: ${os}/${arch}"
    echo "Downloading Cryptek v${VERSION}..."
    echo

    # Create temp directory
    local tmpdir
    tmpdir=$(mktemp -d)
    trap "rm -rf \"$tmpdir\"" EXIT

    # Download binary
    local download_url="${BASE_URL}/${filename}"
    download "$download_url" "${tmpdir}/${filename}"

    # Download checksums
    echo "Verifying checksum..."
    download "${BASE_URL}/checksums.txt" "${tmpdir}/checksums.txt"

    # Extract expected checksum for this file
    local expected_hash
    expected_hash=$(grep "${filename}" "${tmpdir}/checksums.txt" | awk '{print $1}')

    if [ -z "$expected_hash" ]; then
        print_error "No checksum entry for ${filename} in checksums.txt"
        echo "Refusing to install an unverified binary. This likely means a"
        echo "broken release upload - please report it."
        exit 1
    fi
    if ! verify_checksum "${tmpdir}/${filename}" "$expected_hash"; then
        exit 1
    fi
    print_success "Checksum verified"

    # Extract binary
    echo "Extracting..."
    tar -xzf "${tmpdir}/${filename}" -C "$tmpdir"

    # Create install directory
    mkdir -p "$INSTALL_DIR"

    # Move binary to install location
    mv "${tmpdir}/cryptek" "${INSTALL_DIR}/cryptek"
    chmod +x "${INSTALL_DIR}/cryptek"

    print_success "Installed to ${INSTALL_DIR}/cryptek"
    echo

    # Check if install dir is in PATH
    if [[ ":$PATH:" != *":$INSTALL_DIR:"* ]]; then
        print_warning "${INSTALL_DIR} is not in your PATH"
        echo
        echo "Add this to your shell configuration (~/.bashrc, ~/.zshrc, etc.):"
        echo
        echo "  export PATH=\"\$PATH:${INSTALL_DIR}\""
        echo
        echo "Then restart your shell or run:"
        echo
        echo "  source ~/.bashrc  # or ~/.zshrc"
        echo
    fi

    # Verify installation
    if command -v cryptek &> /dev/null || [ -x "${INSTALL_DIR}/cryptek" ]; then
        echo "Installation complete!"
        echo
        echo "Get started:"
        echo "  cryptek --help"
        echo
        echo "Encrypt a file:"
        echo "  cryptek encrypt myfile.txt -s"
        echo
    fi
}

main "$@"