#!/bin/sh
# ClickProbe proxy installer — macOS / Linux.
#
# Usage:
#   curl -fsSL https://clickprobe.ai/install.sh | bash
#
# Downloads the correct clickprobe-proxy archive for this machine from
# https://clickprobe.ai/downloads/latest/, verifies its SHA256 checksum
# against the published SHA256SUMS file, extracts the binary, and installs
# it on PATH. Aborts on any checksum mismatch — this script is piped
# directly into a shell, so it verifies before it trusts.
set -eu

DOWNLOAD_BASE="https://clickprobe.ai/downloads/latest"
BIN_NAME="clickprobe-proxy"

log() { printf '%s\n' "$*"; }
err() { printf 'error: %s\n' "$*" >&2; }
die() { err "$*"; exit 1; }

need_cmd() {
  if ! command -v "$1" >/dev/null 2>&1; then
    die "required command not found: $1"
  fi
}

need_cmd curl
need_cmd tar
need_cmd mktemp

os="$(uname -s)"
arch="$(uname -m)"

case "$os" in
  Darwin)
    platform="darwin"
    # macOS ships a universal (Apple Silicon + Intel) archive — no arch
    # detection needed, and it avoids Rosetta ambiguity on Apple Silicon.
    archive="clickprobe-proxy-darwin-universal.tar.gz"
    ;;
  Linux)
    platform="linux"
    case "$arch" in
      x86_64|amd64) archive="clickprobe-proxy-linux-amd64.tar.gz" ;;
      aarch64|arm64) archive="clickprobe-proxy-linux-arm64.tar.gz" ;;
      *) die "unsupported Linux architecture: $arch (supported: x86_64, aarch64)" ;;
    esac
    ;;
  *)
    die "unsupported OS: $os (this script supports macOS and Linux; for Windows use https://clickprobe.ai/install.ps1)"
    ;;
esac

log "ClickProbe proxy installer"
log "  platform: $platform"
log "  archive:  $archive"

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

log "Downloading $archive..."
curl -fsSL -o "$tmpdir/$archive" "$DOWNLOAD_BASE/$archive"

log "Downloading SHA256SUMS..."
curl -fsSL -o "$tmpdir/SHA256SUMS" "$DOWNLOAD_BASE/SHA256SUMS"

log "Verifying checksum..."
expected="$(grep " $archive\$" "$tmpdir/SHA256SUMS" | awk '{print $1}')"
if [ -z "$expected" ]; then
  die "no checksum entry for $archive in SHA256SUMS — aborting, refusing to install an unverified binary"
fi

if command -v sha256sum >/dev/null 2>&1; then
  actual="$(sha256sum "$tmpdir/$archive" | awk '{print $1}')"
elif command -v shasum >/dev/null 2>&1; then
  actual="$(shasum -a 256 "$tmpdir/$archive" | awk '{print $1}')"
else
  die "no sha256sum or shasum available — cannot verify the download, refusing to install"
fi

if [ "$expected" != "$actual" ]; then
  die "checksum mismatch for $archive
  expected: $expected
  actual:   $actual
Refusing to install a binary that does not match the published checksum."
fi
log "Checksum OK."

log "Extracting..."
tar -xzf "$tmpdir/$archive" -C "$tmpdir"

if [ ! -f "$tmpdir/$BIN_NAME" ]; then
  die "extracted archive did not contain $BIN_NAME — installer or archive layout has changed"
fi
chmod +x "$tmpdir/$BIN_NAME"

default_install_dir="/usr/local/bin"
install_dir="$default_install_dir"
if [ -w "$install_dir" ] || [ "$(id -u)" = "0" ]; then
  mkdir -p "$install_dir"
  mv "$tmpdir/$BIN_NAME" "$install_dir/$BIN_NAME"
else
  install_dir="$HOME/.local/bin"
  mkdir -p "$install_dir"
  mv "$tmpdir/$BIN_NAME" "$install_dir/$BIN_NAME"
  log ""
  log "Note: $default_install_dir is not writable without root, so the proxy was"
  log "installed to $install_dir instead. Make sure it's on your PATH, e.g.:"
  log "  export PATH=\"\$HOME/.local/bin:\$PATH\""
fi

log ""
log "Installed: $install_dir/$BIN_NAME"

if [ "$platform" = "darwin" ]; then
  log ""
  log "macOS Gatekeeper note: this binary is unsigned for the beta. On first"
  log "run, macOS may block it. Run this once to allow it:"
  log "  xattr -d com.apple.quarantine $install_dir/$BIN_NAME"
fi

log ""
log "Next step — bind the proxy to your ClickProbe account:"
log "  $install_dir/$BIN_NAME install --device --service"