#!/usr/bin/env bash
set -euo pipefail

REPO="Sebi/ssh-netbox-wrapper"
BASE_URL="https://git.zb-server.de"
BINARY="netssh"
INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"

# --- helpers -----------------------------------------------------------------

red()   { printf '\033[31m%s\033[0m\n' "$*"; }
green() { printf '\033[32m%s\033[0m\n' "$*"; }
bold()  { printf '\033[1m%s\033[0m\n' "$*"; }
info()  { printf '  %s\n' "$*"; }

die() { red "error: $*" >&2; exit 1; }

need() {
  command -v "$1" &>/dev/null || die "'$1' is required but not installed"
}

# --- detect OS / arch --------------------------------------------------------

detect_os() {
  case "$(uname -s)" in
    Linux)  echo linux ;;
    Darwin) echo darwin ;;
    *)      die "unsupported OS: $(uname -s)" ;;
  esac
}

detect_arch() {
  case "$(uname -m)" in
    x86_64|amd64)   echo amd64 ;;
    aarch64|arm64)  echo arm64 ;;
    *)              die "unsupported architecture: $(uname -m)" ;;
  esac
}

# --- main --------------------------------------------------------------------

need curl

OS=$(detect_os)
ARCH=$(detect_arch)

bold "netssh installer"
info "platform : $OS/$ARCH"
info "target   : $INSTALL_DIR/$BINARY"

# Fetch the latest release tag from the Gitea API.
API_URL="$BASE_URL/api/v1/repos/$REPO/releases/latest"
TAG=$(curl -sf "$API_URL" | python3 -c "import sys,json; print(json.load(sys.stdin)['tag_name'])") \
  || die "could not fetch latest release from $API_URL"

ASSET="${BINARY}_${OS}_${ARCH}"
DOWNLOAD_URL="$BASE_URL/$REPO/releases/download/$TAG/$ASSET"
CHECKSUM_URL="$BASE_URL/$REPO/releases/download/$TAG/checksums.txt"

info "version  : $TAG"
echo

# Download binary and checksums into a temp directory.
TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT

info "downloading $ASSET..."
curl -fL --progress-bar -o "$TMP/$ASSET" "$DOWNLOAD_URL"

info "verifying checksum..."
curl -sf -o "$TMP/checksums.txt" "$CHECKSUM_URL" \
  || { info "warning: could not fetch checksums, skipping verification"; }

if [[ -f "$TMP/checksums.txt" ]]; then
  # checksums.txt was built with `sha256sum` in the dist/ dir, so entries look
  # like "abc123  netssh_linux_amd64". We need to cd into the temp dir first.
  (cd "$TMP" && grep "$ASSET" checksums.txt | sha256sum --check --status) \
    || die "checksum mismatch — aborting installation"
  info "checksum OK"
fi

chmod +x "$TMP/$ASSET"

# Install — try without sudo first, fall back if needed.
if [[ -w "$INSTALL_DIR" ]]; then
  mv "$TMP/$ASSET" "$INSTALL_DIR/$BINARY"
else
  info "sudo required to write to $INSTALL_DIR"
  sudo mv "$TMP/$ASSET" "$INSTALL_DIR/$BINARY"
fi

echo
green "✓ netssh $TAG installed to $INSTALL_DIR/$BINARY"
info "run 'netssh --help' to get started"