# Walkabit relay web installer (Windows PowerShell):  irm https://walkabit.dev/install.ps1 | iex
#
# A thin bootstrap. It downloads the relay package from walkabit.dev, verifies its SHA-256 checksum, unpacks it into
# a temporary folder and runs the package's own install.ps1, passing arguments through. With `iex` you cannot pass
# arguments directly; either set $env:WALKABIT_INSTALL_ARGS (space separated) first, or run:
#   & ([scriptblock]::Create((irm https://walkabit.dev/install.ps1))) --workspace C:\code
#
# It never asks for, reads or sends any secret or credential. Read it before you run it; it is short.
# Override the source (e.g. for testing): $env:WALKABIT_BASE_URL = 'http://localhost:8000'
# UNVERIFIED on a real Windows machine (written without one).
$ErrorActionPreference = 'Stop'
$ProgressPreference = 'SilentlyContinue'

$base = if ($env:WALKABIT_BASE_URL) { $env:WALKABIT_BASE_URL } else { 'https://walkabit.dev' }
$name = 'walkabit-relay-latest.tar.gz'
$passArgs = @($args)
if ($passArgs.Count -eq 0 -and $env:WALKABIT_INSTALL_ARGS) { $passArgs = @($env:WALKABIT_INSTALL_ARGS -split '\s+' | Where-Object { $_ }) }

$tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("walkabit-install-" + [System.Guid]::NewGuid().ToString('N'))
New-Item -ItemType Directory -Path $tmp | Out-Null
$exit = 0
try {
  if (-not (Get-Command tar -ErrorAction SilentlyContinue)) { throw 'tar.exe is required (included with Windows 10 and later).' }

  Write-Host "Downloading the Walkabit relay from $base ..."
  $archive = Join-Path $tmp $name
  try { Invoke-WebRequest -UseBasicParsing -Uri "$base/downloads/$name" -OutFile $archive }
  catch { throw "Could not download $base/downloads/$name. The relay package may not be published yet. See $base/downloads/" }

  # Verify against the published checksum when there is one.
  $want = $null
  try {
    $sumFile = Join-Path $tmp "$name.sha256"
    Invoke-WebRequest -UseBasicParsing -Uri "$base/downloads/$name.sha256" -OutFile $sumFile
    $want = ((Get-Content -Raw $sumFile).Trim() -split '\s+')[0].ToLowerInvariant()
  } catch { $want = $null }
  if ($want) {
    $got = (Get-FileHash -Algorithm SHA256 $archive).Hash.ToLowerInvariant()
    if ($got -ne $want) { throw "Checksum mismatch for $name (expected $want, got $got). Aborting." }
    Write-Host "Checksum OK ($got)"
  } else {
    Write-Warning "No checksum published at $base/downloads/$name.sha256; continuing without verification."
  }

  & tar -xzf $archive -C $tmp
  if ($LASTEXITCODE -ne 0) { throw 'Could not extract the package.' }
  $installer = Get-ChildItem -Path $tmp -Directory -Filter 'walkabit-relay-*' | ForEach-Object { Join-Path $_.FullName 'install.ps1' } | Where-Object { Test-Path $_ } | Select-Object -First 1
  if (-not $installer) { throw 'install.ps1 not found in the downloaded package.' }

  $shell = (Get-Process -Id $PID).Path
  & $shell -NoProfile -ExecutionPolicy Bypass -File $installer @passArgs
  $exit = $LASTEXITCODE
} catch {
  Write-Host $_.Exception.Message -ForegroundColor Red
  $exit = 1
} finally {
  Remove-Item -Recurse -Force $tmp -ErrorAction SilentlyContinue
}
if ($exit -ne 0) { Write-Host "Walkabit install did not finish (exit code $exit)." -ForegroundColor Red }