#!/usr/bin/env bash
set -euo pipefail

if [[ ${EUID} -ne 0 ]]; then
  echo 'install.sh must run as root' >&2
  exit 1
fi

ALLOW_NONPRODUCTION=false
START=false
for arg in "$@"; do
  case "$arg" in
    --allow-nonproduction) ALLOW_NONPRODUCTION=true ;;
    --start) START=true ;;
    *) echo "unknown option: $arg" >&2; exit 2 ;;
  esac
done

PACKAGE_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
cd -- "$PACKAGE_DIR"
[[ -f package.SHA256SUMS ]] || { echo 'package.SHA256SUMS is missing' >&2; exit 1; }
sha256sum -c package.SHA256SUMS

. /etc/os-release
[[ ${ID:-} == debian && ${VERSION_ID:-} == 13 ]] || {
  echo 'Debian 13 is required' >&2
  exit 1
}
[[ $(uname -m) == x86_64 ]] || { echo 'amd64 host is required' >&2; exit 1; }

if ! grep -q '"source_dirty": false' manifest.json ||
   ! grep -q '"production_approval": true' manifest.json; then
  if [[ "$ALLOW_NONPRODUCTION" != true ]]; then
    echo 'release is dirty or not production-approved; use an approved package or --allow-nonproduction for smoke only' >&2
    exit 1
  fi
fi

VERSION=$(awk -F'"' '/"version"[[:space:]]*:/ {print $4; exit}' manifest.json)
LOCK_VERSION=$(awk -F'"' '/"version"[[:space:]]*:/ {print $4; exit}' versions.lock.json)
[[ "$VERSION" =~ ^[0-9A-Za-z][0-9A-Za-z.+_-]*$ ]] || { echo 'invalid release version' >&2; exit 1; }
[[ "$VERSION" == "$LOCK_VERSION" ]] || { echo 'release/version lock mismatch' >&2; exit 1; }

id -u rogee >/dev/null 2>&1 || useradd --create-home --shell /bin/bash rogee
install -d -m 0755 /opt/sip-go-agent/releases \
  /etc/sip-go-agent/pki /etc/sip-go-agent/artifacts
install -d -m 0700 -o rogee -g rogee \
  /var/lib/sip-go-agent/agent /var/lib/sip-go-agent/agent/spool \
  /var/lib/sip-go-agent/dispatcher
install -m 0755 cell/nonprod-call-evidence.sh /usr/local/sbin/agent-call-nonprod-evidence
command -v visudo >/dev/null || { echo 'visudo is required for the non-production capture gate' >&2; exit 1; }
cat >/etc/sudoers.d/agent-call-nonprod-evidence <<'EOF'
rogee ALL=(root) NOPASSWD: /usr/local/sbin/agent-call-nonprod-evidence
EOF
chmod 0440 /etc/sudoers.d/agent-call-nonprod-evidence
visudo -cf /etc/sudoers.d/agent-call-nonprod-evidence >/dev/null

RELEASE_DIR=/opt/sip-go-agent/releases/$VERSION
install -d -m 0755 "$RELEASE_DIR"
install -m 0755 sip-go-agent "$RELEASE_DIR/sip-go-agent"
install -m 0644 go.mod go.sum manifest.json versions.lock.json "$RELEASE_DIR/"
ln -sfn "$RELEASE_DIR" /opt/sip-go-agent/current
chown -R root:root /opt/sip-go-agent/releases "$RELEASE_DIR"

install -m 0644 systemd/sip-go-agent-agent.service /etc/systemd/system/sip-go-agent-agent.service
install -m 0644 systemd/sip-go-agent-dispatcher.service /etc/systemd/system/sip-go-agent-dispatcher.service
if [[ ! -e /etc/sip-go-agent/agent.env ]]; then
  install -m 0600 env/agent.env.example /etc/sip-go-agent/agent.env
fi
if [[ ! -e /etc/sip-go-agent/dispatcher.env ]]; then
  install -m 0600 env/dispatcher.env.example /etc/sip-go-agent/dispatcher.env
fi
if [[ ! -e /etc/sip-go-agent/agent-endpoints.json ]]; then
  install -m 0644 config/agent-endpoints.example.json /etc/sip-go-agent/agent-endpoints.json
fi
install -m 0644 versions.lock.json /etc/sip-go-agent/versions.lock.json
systemctl daemon-reload
systemctl enable sip-go-agent-agent.service sip-go-agent-dispatcher.service

if [[ "$START" == true ]]; then
  systemctl restart sip-go-agent-dispatcher.service sip-go-agent-agent.service
fi
printf 'installed version=%s mode=physical-systemd start=%s\n' "$VERSION" "$START"