#!/usr/bin/env bash
set -Eeuo pipefail

umask 077

ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
INSTALLER="$ROOT/deploy/install.sh"
INSTALLER_SHA256=${KAIDI_INSTALLER_SHA256:-5aadfab9bdeef9279aeab6eee9baaae7182b2f3338fa61a558b3c073b69ad396}
RELEASE_API_URL=${KAIDI_RELEASE_API_URL:-https://git.awaioi.com/api/v1/repos/ERP-Team/kaidi/releases/latest}
PUBLIC_KEY_SHA256=${KAIDI_RELEASE_PUBLIC_KEY_SHA256:-807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9}
TOKEN_FILE=${KAIDI_RELEASE_TOKEN_FILE:-}

log() { printf '[kaidi-git-install] %s\n' "$*"; }

localize_message() {
  local message=$1
  [ "${KAIDI_LOG_LOCALE:-zh-CN}" = en ] && { printf '%s' "$message"; return; }
  case "$message" in
    "deploy/install.sh is missing"*) printf '缺少 deploy/install.sh，请在 Kaidi Git 工作区运行此命令' ;;
    "sha256sum is required") printf '需要 sha256sum' ;;
    "The installer SHA-256 is invalid") printf '安装器 SHA-256 无效' ;;
    "The release public-key SHA-256 is invalid") printf '发布公钥 SHA-256 无效' ;;
    "deploy/install.sh does not match"*) printf 'deploy/install.sh 与该 Git 标签的受信摘要不一致' ;;
    "sudo is required when not running as root") printf '非 root 用户运行时需要 sudo' ;;
    "The Gitea token file is not a regular file") printf 'Gitea Token 文件必须是普通文件' ;;
    "The Gitea token file must contain 1 to 512 bytes") printf 'Gitea Token 文件必须包含 1 到 512 字节' ;;
    "The Gitea token file contains invalid control characters") printf 'Gitea Token 文件包含无效控制字符' ;;
    *) printf '%s' "$message" ;;
  esac
}

die() { printf '[kaidi-git-install] 错误：%s\n' "$(localize_message "$*")" >&2; exit 1; }

[ -f "$INSTALLER" ] || die "deploy/install.sh is missing; run this command from the Kaidi Git checkout"
command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
[[ "$INSTALLER_SHA256" =~ ^[0-9A-Fa-f]{64}$ ]] || die "The installer SHA-256 is invalid"
[[ "$PUBLIC_KEY_SHA256" =~ ^[0-9A-Fa-f]{64}$ ]] || die "The release public-key SHA-256 is invalid"
actual_installer_sha256=$(sha256sum "$INSTALLER" | awk '{print $1}')
normalized_actual_installer_sha256=$(printf '%s' "$actual_installer_sha256" | tr '[:upper:]' '[:lower:]')
normalized_installer_sha256=$(printf '%s' "$INSTALLER_SHA256" | tr '[:upper:]' '[:lower:]')
[ "$normalized_actual_installer_sha256" = "$normalized_installer_sha256" ] \
  || die "deploy/install.sh does not match the trusted SHA-256 for this Git tag"

root_command=(env)
if [ "$(id -u)" -ne 0 ]; then
  command -v sudo >/dev/null 2>&1 || die "sudo is required when not running as root"
  root_command=(sudo env)
fi

install_env=(
  "KAIDI_RELEASE_API_URL=$RELEASE_API_URL"
  "KAIDI_RELEASE_PUBLIC_KEY_SHA256=$PUBLIC_KEY_SHA256"
)

if [ -n "$TOKEN_FILE" ]; then
  [ -f "$TOKEN_FILE" ] && [ ! -L "$TOKEN_FILE" ] || die "The Gitea token file must be a regular file"
  token_size=$(wc -c < "$TOKEN_FILE" | tr -d '[:space:]')
  [ "$token_size" -gt 0 ] && [ "$token_size" -le 512 ] || die "The Gitea token file must contain 1 to 512 bytes"
  LC_ALL=C grep -q '[[:cntrl:]]' "$TOKEN_FILE" && die "The Gitea token file contains invalid control characters"
  install_env+=("KAIDI_RELEASE_TOKEN_FILE=$TOKEN_FILE")
fi

KAIDI_REINSTALL=${KAIDI_REINSTALL:-}
KAIDI_SETUP_WIZARD=${KAIDI_SETUP_WIZARD:-}
KAIDI_APP_PORT=${KAIDI_APP_PORT:-}
KAIDI_SERVER_ADDRESS=${KAIDI_SERVER_ADDRESS:-}
KAIDI_DB_URL=${KAIDI_DB_URL:-}
KAIDI_DB_USERNAME=${KAIDI_DB_USERNAME:-}
KAIDI_DB_PASSWORD=${KAIDI_DB_PASSWORD:-}
KAIDI_DB_HOST=${KAIDI_DB_HOST:-}
KAIDI_DB_PORT=${KAIDI_DB_PORT:-}
KAIDI_DB_NAME=${KAIDI_DB_NAME:-}
KAIDI_SESSION_COOKIE_SECURE=${KAIDI_SESSION_COOKIE_SECURE:-}
KAIDI_FILE_SCANNER_ENABLED=${KAIDI_FILE_SCANNER_ENABLED:-}
KAIDI_DB_BACKUP_MODE=${KAIDI_DB_BACKUP_MODE:-}

for name in KAIDI_REINSTALL KAIDI_SETUP_WIZARD KAIDI_APP_PORT KAIDI_SERVER_ADDRESS \
  KAIDI_DB_URL KAIDI_DB_USERNAME KAIDI_DB_PASSWORD \
  KAIDI_DB_HOST KAIDI_DB_PORT KAIDI_DB_NAME \
  KAIDI_SESSION_COOKIE_SECURE KAIDI_FILE_SCANNER_ENABLED KAIDI_DB_BACKUP_MODE; do
  value=${!name}
  if [ -n "$value" ]; then
    install_env+=("$name=$value")
  fi
done

log "正在从 Gitea Release API 安装最新签名版本：$RELEASE_API_URL"
"${root_command[@]}" "${install_env[@]}" bash "$INSTALLER"