#!/bin/sh
# Hosted Linux installer. Never accepts passwords/tokens or opens public ports.
set -eu
install_email=''
install_check=0
while test "$#" -gt 0; do
    case "$1" in
        --help|-h)
            printf '%s\n' 'Usage: sudo sh install-cli.sh [--email account@example.com] [--check]' \
                'Installs the verified Linux CLI and AirFS helper in /usr/local/bin.' \
                'Preserves an existing service/login; enables airmsh-cli.service.' \
                '--email prompts securely on /dev/tty only when login is missing.' \
                '--check checks prerequisites without downloading or changing files.'
            exit 0 ;;
        --check) install_check=1; shift ;;
        --email)
            test "$#" -ge 2 || { printf 'Provide an account email.\n' >&2; exit 2; }
            install_email=$2
            case "$install_email" in -*|*[!a-zA-Z0-9_.+@-]*|'') printf 'Invalid email argument.\n' >&2; exit 2;; esac
            case "$install_email" in *@*.*) ;; *) printf 'Provide an account email.\n' >&2; exit 2;; esac
            shift 2 ;;
        *) printf 'Unknown argument; use --help.\n' >&2; exit 2 ;;
    esac
done
test "$(uname -s)" = Linux || { printf 'This installer requires Linux with systemd.\n' >&2; exit 1; }
case "$(uname -m)" in
    x86_64|amd64)
        install_platform=linux-amd64
        install_build=106
        install_sha=58d924e810264f8c089e2f5a21d12a7baf3a488e4028dd8befb51604907fe742 ;;
    aarch64|arm64)
        install_platform=linux-arm64
        install_build=106
        install_sha=7affe56a5baa411dfef629f572bdb4bfe0f9c762a646f65e76c6b32d78e44c96 ;;
    *) printf 'Unsupported Linux architecture.\n' >&2; exit 1 ;;
esac
test "$(id -u)" = 0 || { printf 'Run this installer with sudo.\n' >&2; exit 1; }
for install_tool in curl tar sha256sum install mktemp systemctl getent awk cut ip; do
    command -v "$install_tool" >/dev/null 2>&1 || { printf 'Missing prerequisite: %s. Install it before retrying.\n' "$install_tool" >&2; exit 1; }
done
test -d /run/systemd/system || { printf 'systemd must be running; no service changes made.\n' >&2; exit 1; }
install_home=$(getent passwd 0 | cut -d : -f 6)
case "$install_home" in /*) ;; *) printf 'Cannot resolve the root account home.\n' >&2; exit 1;; esac
case "$install_home" in *[!a-zA-Z0-9/_-]*|/) printf 'Unsupported root home path.\n' >&2; exit 1;; esac
install_state="$install_home/.airmsh"
test ! -L "$install_state" || { printf 'Refusing a symlinked CLI state directory.\n' >&2; exit 1; }
if test -e "$install_state"; then
    test "$(stat -c '%u' "$install_state")" = 0 || { printf 'CLI state directory must belong to root.\n' >&2; exit 1; }
fi
install_unit=/etc/systemd/system/airmsh-cli.service
install_existing_unit=$(systemctl show airmsh-cli.service -p FragmentPath --value 2>/dev/null || true)
if test -n "$install_existing_unit"; then
    install_exec=$(systemctl show airmsh-cli.service -p ExecStart --value)
    case "$install_exec" in *'path=/usr/local/bin/airmsh-cli ; argv[]=/usr/local/bin/airmsh-cli service ;'*) ;;
        *) printf 'Existing custom service uses another command; configuration left untouched.\n' >&2; exit 1;;
    esac
    test "$(systemctl show airmsh-cli.service -p User --value)" = root || {
        printf 'Existing service uses another OS account; configuration left untouched.\n' >&2; exit 1;
    }
fi
if test "$install_check" = 1; then
    printf 'Ready: Linux %s CLI build %s -> /usr/local/bin/airmsh-cli; systemd service. No changes applied.\n' "$install_platform" "$install_build"
    exit 0
fi
umask 077
install_was_active=0
install_was_enabled=0
systemctl is-active --quiet airmsh-cli.service && install_was_active=1
systemctl is-enabled --quiet airmsh-cli.service 2>/dev/null && install_was_enabled=1
install_mutated=0
install_stage=$(mktemp -d /var/tmp/airmsh-cli-installer.XXXXXXXX)
finish() {
    install_result=$?
    trap - EXIT HUP INT TERM
    if test "$install_result" -ne 0 && test "$install_mutated" = 1; then
        set +e
        systemctl stop airmsh-cli.service
        for install_file in airmsh-cli airfs; do
            if test -f "$install_backup/$install_file"; then
                install -m 755 "$install_backup/$install_file" "/usr/local/bin/$install_file.rollback-next"
                mv -f "/usr/local/bin/$install_file.rollback-next" "/usr/local/bin/$install_file"
            else
                unlink "/usr/local/bin/$install_file"
            fi
        done
        if test -z "$install_existing_unit"; then
            systemctl disable airmsh-cli.service
            unlink "$install_unit"
        elif test "$install_was_enabled" = 0; then
            systemctl disable airmsh-cli.service
        fi
        systemctl daemon-reload
        if test "$install_was_active" = 1; then systemctl start airmsh-cli.service; fi
        printf 'Installation failed; previous binaries/service state restored. Login files were preserved.\n' >&2
    fi
    case "$install_stage" in /var/tmp/airmsh-cli-installer.*) rm -rf -- "$install_stage";; esac
    exit "$install_result"
}
trap finish EXIT
trap 'exit 130' HUP INT TERM
install_archive="airmsh-cli-$install_platform-1.0.3-build$install_build.tar.gz"
curl --fail --silent --show-error --proto '=https' --tlsv1.2 --connect-timeout 10 --max-time 180 \
    "https://airmsh.com/downloads/$install_archive" -o "$install_stage/package.tar.gz"
printf '%s  %s/package.tar.gz\n' "$install_sha" "$install_stage" | sha256sum -c -
tar -tzf "$install_stage/package.tar.gz" | awk '/^\// || /(^|\/)\.\.($|\/)/ {bad=1} END {exit bad}'
mkdir "$install_stage/package"
tar -xzf "$install_stage/package.tar.gz" -C "$install_stage/package" --no-same-owner
test -f "$install_stage/package/airmsh-cli" && test ! -L "$install_stage/package/airmsh-cli"
test -f "$install_stage/package/airfs" && test ! -L "$install_stage/package/airfs"
chmod 755 "$install_stage/package/airmsh-cli"
"$install_stage/package/airmsh-cli" --version
"$install_stage/package/airmsh-cli" setup --check
test ! -L /usr/local/bin/airmsh-cli && test ! -L /usr/local/bin/airfs
test ! -e /usr/local/bin/airmsh-cli.install-next && test ! -e /usr/local/bin/airfs.install-next
mkdir -p /opt/airmsh/cli-install-backups /usr/local/bin
install_backup=$(mktemp -d /opt/airmsh/cli-install-backups/installer.XXXXXXXX)
for install_file in airmsh-cli airfs; do
    if test -f "/usr/local/bin/$install_file"; then cp -p "/usr/local/bin/$install_file" "$install_backup/$install_file"; fi
done
if test -n "$install_existing_unit"; then cp -p "$install_existing_unit" "$install_backup/airmsh-cli.service"; fi
install_mutated=1
install -m 755 "$install_stage/package/airmsh-cli" /usr/local/bin/airmsh-cli.install-next
install -m 755 "$install_stage/package/airfs" /usr/local/bin/airfs.install-next
mv -f /usr/local/bin/airmsh-cli.install-next /usr/local/bin/airmsh-cli
mv -f /usr/local/bin/airfs.install-next /usr/local/bin/airfs
install -d -m 700 "$install_state"
if test -z "$install_existing_unit"; then
    test ! -e "$install_unit" && test ! -L "$install_unit"
    {
        printf '%s\n' '[Unit]' 'Description=Airmsh native mesh CLI service' 'Wants=network-online.target' 'After=network-online.target' '' '[Service]' 'Type=simple' 'User=root'
        printf 'WorkingDirectory=%s\n' "$install_state"
        printf '%s\n' 'ExecStart=/usr/local/bin/airmsh-cli service' 'Restart=on-failure' 'RestartSec=5' 'UMask=0077' '' '[Install]' 'WantedBy=multi-user.target'
    } > "$install_stage/airmsh-cli.service"
    install -m 644 "$install_stage/airmsh-cli.service" "$install_unit"
fi
/usr/local/bin/airmsh-cli setup
systemctl daemon-reload
systemctl enable airmsh-cli.service
if test ! -f "$install_state/session.json" && test "$install_was_active" = 0 && test -n "$install_email"; then
    if test -r /dev/tty && (test -t 0 </dev/tty) 2>/dev/null; then
        /usr/local/bin/airmsh-cli resource login "$install_email" </dev/tty
    else
        printf 'No interactive terminal; login was not attempted.\n' >&2
    fi
fi
if test -f "$install_state/session.json" || systemctl is-active --quiet airmsh-cli.service; then
    systemctl restart airmsh-cli.service
    sleep 2
    if ! systemctl is-active --quiet airmsh-cli.service; then
        printf 'Service did not start. Check: sudo journalctl -u airmsh-cli -n 30\nBackups: %s\n' "$install_backup" >&2
        exit 1
    fi
    printf 'CLI installed and service running. Check: sudo systemctl status airmsh-cli\n'
else
    printf '%s\n' 'CLI installed; service enabled for boot, awaiting your first login:' \
        '  sudo airmsh-cli resource login YOUR_EMAIL' \
        '  sudo systemctl start airmsh-cli'
fi
printf 'CLI path: /usr/local/bin/airmsh-cli\nAirFS helper: /usr/local/bin/airfs\nBackup: %s\n' "$install_backup"