#!/usr/bin/env bash
# Walkabit relay web installer (Linux and macOS):  curl -fsSL https://walkabit.dev/install.sh | bash
#
# A thin bootstrap. It downloads the relay package from walkabit.dev, verifies its SHA-256 checksum, unpacks it
# into a temporary folder and runs the package's own install.sh, passing every argument through:
#   curl -fsSL https://walkabit.dev/install.sh | bash -s -- --workspace ~/code --no-browser
#
# It never asks for, reads or sends any secret or credential. Read it before you run it; it is short.
# Override the source (e.g. for testing): WALKABIT_BASE_URL=http://localhost:8000
set -euo pipefail

tmp=
main() {
  local base="${WALKABIT_BASE_URL:-https://walkabit.dev}"
  local name="walkabit-relay-latest.tar.gz"
  tmp=$(mktemp -d "${TMPDIR:-/tmp}/walkabit-install.XXXXXX")
  trap 'rm -rf "${tmp:-}"' EXIT

  command -v curl >/dev/null 2>&1 || { echo "curl is required." >&2; exit 1; }
  command -v tar >/dev/null 2>&1 || { echo "tar is required." >&2; exit 1; }

  echo "Downloading the Walkabit relay from $base ..."
  curl -fsSL "$base/downloads/$name" -o "$tmp/$name" || {
    echo "Could not download $base/downloads/$name" >&2
    echo "The relay package may not be published yet. See $base/downloads/" >&2
    exit 1
  }

  # Verify against the published checksum when there is one.
  if curl -fsSL "$base/downloads/$name.sha256" -o "$tmp/$name.sha256" 2>/dev/null; then
    local want got
    want=$(awk '{print $1; exit}' "$tmp/$name.sha256")
    if command -v sha256sum >/dev/null 2>&1; then
      got=$(sha256sum "$tmp/$name" | awk '{print $1}')
    elif command -v shasum >/dev/null 2>&1; then
      got=$(shasum -a 256 "$tmp/$name" | awk '{print $1}')
    else
      got=""
      echo "Warning: no sha256sum or shasum found; skipping checksum verification." >&2
    fi
    if [ -n "$got" ]; then
      if [ "$want" != "$got" ]; then
        echo "Checksum mismatch for $name (expected $want, got $got). Aborting." >&2
        exit 1
      fi
      echo "Checksum OK ($got)"
    fi
  else
    echo "Warning: no checksum published at $base/downloads/$name.sha256; continuing without verification." >&2
  fi

  tar -xzf "$tmp/$name" -C "$tmp"
  local installer
  installer=$(ls -d "$tmp"/walkabit-relay-*/install.sh 2>/dev/null | head -n 1 || true)
  [ -n "$installer" ] && [ -f "$installer" ] || { echo "install.sh not found in the downloaded package." >&2; exit 1; }

  # When piped from curl, stdin is the script itself. Give the installer the terminal so it can ask questions.
  if [ ! -t 0 ] && { : </dev/tty; } 2>/dev/null; then
    bash "$installer" "$@" </dev/tty
  else
    bash "$installer" "$@"
  fi
}

main "$@"