#!/usr/bin/env bash
# samvnc-server official installer for Linux/macOS
# Usage:  curl -fsSL https://samai.cc/samvnc/downloads/install.sh | bash
#   or:   curl -fsSL https://samai.cc/samvnc/downloads/install.sh | bash -s -- --version v1.2.0
#
# Downloads the samvnc-server binary for the current platform to
# /usr/local/bin/samvnc-server (or ~/.local/bin/samvnc-server without sudo).
#
# v1.2.0 improvements (mirrors samaidev/samcommand install.sh):
#   - Reads latest-version.txt to know which version is being installed.
#   - Verifies SHA256 against checksums-sha256.txt after download.
#   - Falls back to no-checksum-verify if the checksums file is unreachable.

set -euo pipefail
BASE_URL="https://samai.cc/samvnc/downloads"
INSTALL_DIR="/usr/local/bin"
BIN_NAME="samvnc-server"

REQUESTED_VERSION=""
while [[ $# -gt 0 ]]; do
    case "$1" in
        --version) REQUESTED_VERSION="$2"; shift 2 ;;
        --no-verify) NO_VERIFY=1; shift ;;
        *) echo "Unknown option: $1" >&2; exit 1 ;;
    esac
done

OS="$(uname -s)"
ARCH="$(uname -m)"
case "$OS" in
    Linux*)  PLATFORM_OS="linux" ;;
    Darwin*) PLATFORM_OS="darwin" ;;
    *) echo "Unsupported OS: $OS" >&2; exit 1 ;;
esac
case "$ARCH" in
    x86_64|amd64)   PLATFORM_ARCH="amd64" ;;
    aarch64|arm64)  PLATFORM_ARCH="arm64" ;;
    armv7l|armv6l|arm) PLATFORM_ARCH="arm" ;;
    *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
esac

PLATFORM="${PLATFORM_OS}-${PLATFORM_ARCH}"
REMOTE_FILE="samvnc-server-${PLATFORM}"
echo "Detected platform: $PLATFORM"

if [[ -z "$REQUESTED_VERSION" ]]; then
    REQUESTED_VERSION="$(curl -fsSL --max-time 10 "$BASE_URL/latest-version.txt" 2>/dev/null || echo unknown)"
fi
echo "Latest version:   $REQUESTED_VERSION"

SUDO=""
if [[ -w "$INSTALL_DIR" ]]; then
    TARGET="${INSTALL_DIR}/${BIN_NAME}"
elif command -v sudo >/dev/null 2>&1 && sudo -n true 2>/dev/null; then
    TARGET="${INSTALL_DIR}/${BIN_NAME}"
    SUDO="sudo"
else
    TARGET="${HOME}/.local/bin/${BIN_NAME}"
    mkdir -p "$(dirname "$TARGET")"
    echo "No sudo access - installing to $TARGET" >&2
    echo "Make sure ${HOME}/.local/bin is in your PATH." >&2
fi

TMP_FILE="$(mktemp -t samvnc-XXXXXX)"
trap 'rm -f "$TMP_FILE"' EXIT

URL="${BASE_URL}/${REMOTE_FILE}"
echo "Downloading $URL ..."
# Add cache-busting query param so CDN/proxy caches don't serve stale binaries.
curl -fSL --retry 3 --retry-delay 2 -o "$TMP_FILE" "${URL}?t=$(date +%s)"

# SHA256 verification (best-effort).
# Tries multiple tools because not every platform has the same one:
#   - shasum -a 256   (macOS default, also some Linux via perl-Digest-SHA)
#   - sha256sum       (Linux coreutils, Termux default)
#   - openssl dgst -sha256 (commonly available fallback)
#   - python3 -c '...' (last-resort, works everywhere python is installed)
compute_sha256() {
    local file="$1"
    if command -v shasum >/dev/null 2>&1; then
        shasum -a 256 "$file" | awk '{print $1}'
    elif command -v sha256sum >/dev/null 2>&1; then
        sha256sum "$file" | awk '{print $1}'
    elif command -v openssl >/dev/null 2>&1; then
        openssl dgst -sha256 "$file" | awk '{print $NF}'
    elif command -v python3 >/dev/null 2>&1; then
        python3 -c "import hashlib; print(hashlib.sha256(open('$file','rb').read()).hexdigest())"
    elif command -v python >/dev/null 2>&1; then
        python -c "import hashlib; print(hashlib.sha256(open('$file','rb').read()).hexdigest())"
    else
        return 1
    fi
}

if [[ -z "${NO_VERIFY:-}" ]]; then
    echo "Verifying SHA256 ..."
    ACTUAL_SHA="$(compute_sha256 "$TMP_FILE")"
    if [[ -z "$ACTUAL_SHA" ]]; then
        echo "  [warn] no SHA256 tool found (tried shasum, sha256sum, openssl, python3, python); skipping verification."
        echo "  To install one:  pkg install coreutils  (Termux)  |  apt install coreutils  (Linux)  |  brew install perl  (macOS)"
    else
        EXPECTED_SHA="$(curl -fsSL --max-time 10 "$BASE_URL/checksums-sha256.txt" 2>/dev/null | awk -v f="$REMOTE_FILE" '$2==f {print $1; exit}')"
        if [[ -z "$EXPECTED_SHA" ]]; then
            echo "  [warn] could not fetch checksums-sha256.txt; skipping verification."
        elif [[ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]]; then
            echo "  [ERROR] SHA256 mismatch!" >&2
            echo "    expected: $EXPECTED_SHA" >&2
            echo "    actual:   $ACTUAL_SHA" >&2
            echo "    file:     $REMOTE_FILE" >&2
            echo "  Aborting. The downloaded binary is corrupted or has been tampered with." >&2
            exit 1
        else
            echo "  [ok] SHA256 matches ($ACTUAL_SHA)"
        fi
    fi
fi

if [[ -n "$SUDO" ]]; then
    $SUDO install -m 0755 "$TMP_FILE" "$TARGET"
else
    install -m 0755 "$TMP_FILE" "$TARGET"
fi

if [[ "$PLATFORM_OS" == "darwin" ]]; then
    if command -v xattr >/dev/null 2>&1; then
        xattr -d com.apple.quarantine "$TARGET" 2>/dev/null || true
    fi
fi

# ---- Also install aitun-client (the tunnel client samvnc depends on) ----
AITUN_DATA_DIR="${HOME}/.samvnc"
AITUN_REMOTE="aitun-client-${PLATFORM}"
if [[ "$PLATFORM_OS" == "windows" ]]; then
    AITUN_REMOTE="aitun-client-${PLATFORM_OS}-${PLATFORM_ARCH}.exe"
fi
AITUN_TARGET="${AITUN_DATA_DIR}/${AITUN_REMOTE}"

mkdir -p "$AITUN_DATA_DIR"

if [[ -x "$AITUN_TARGET" ]] && [[ "${FORCE:-0}" != "1" ]]; then
    echo "aitun-client already installed at $AITUN_TARGET (skip)"
else
    AITUN_URL="https://aitun.cc/downloads/${AITUN_REMOTE}"
    echo "Downloading aitun-client (tunnel client) ..."
    if curl -fSL --retry 3 --retry-delay 2 -o "$AITUN_TARGET" "${AITUN_URL}?t=$(date +%s)" 2>&1; then
        chmod 0755 "$AITUN_TARGET"
        AITUN_SIZE=$(wc -c < "$AITUN_TARGET" | tr -d ' ')
        echo "  [ok] aitun-client installed ($AITUN_SIZE bytes) -> $AITUN_TARGET"
    else
        echo "  [warn] could not download aitun-client from $AITUN_URL"
        rm -f "$AITUN_TARGET"
    fi
fi

echo "Installed: $TARGET"
echo
echo "Done! Try it now:"
echo "    samvnc-server --help"
echo "    samvnc-server -verbose   # full mode (aitun-client pre-installed)"