#!/bin/bash
# Nodebase client one-line installer, served from the download host:
#
#   curl -fsSL https://dl-us.nodebase.com/install.sh | bash
#
# Published to /srv/nodebase-dl by the release flow (make release-client puts
# it in dist/ next to the binaries). It must stay dependency-free beyond curl
# and the stock sha256 tool, because it runs on machines that have nothing
# else installed yet.
#
# Env overrides:
#   NODEBASE_DL_URL      download server; when unset the installer tries the
#                        servers below in order (US mirror first)
#   NODEBASE_INSTALL_DIR install target (default /usr/local/bin)
set -euo pipefail

# Download servers, tried in order: brand domain first, u24.net backup — and
# within each, the US mirror before the Tokyo origin. US-first keeps the large
# binary off the origin's CN2 IP (the same address the control plane rides);
# the u24.net pair is the fallback for when the brand domain is DNS-poisoned.
SERVERS=(https://dl-us.nodebase.com https://dl.nodebase.com https://dl-us.u24.net https://dl.u24.net)
INSTALL_DIR=${NODEBASE_INSTALL_DIR:-/usr/local/bin}

# Only the three published build targets exist (Makefile release-client);
# anything else must fail here rather than 404 confusingly later.
OS=$(uname -s) ARCH=$(uname -m)
case "$OS/$ARCH" in
  Darwin/arm64)          ASSET=nodebase-darwin-arm64 ;;
  Darwin/x86_64)         ASSET=nodebase-darwin-amd64 ;;
  Linux/x86_64)          ASSET=nodebase-linux-amd64 ;;
  *) echo "unsupported platform: $OS $ARCH (builds exist for macOS arm64/amd64 and Linux amd64)" >&2
     exit 1 ;;
esac

fetch() { curl -fsSL --connect-timeout 8 "$@"; }

# An explicit NODEBASE_DL_URL is honored with no fallback — if the user picked
# a server, silently switching to another would be surprising. Otherwise try
# each server in order and take the first that answers. Output never names the
# server: which host served the download must not travel in a shared log.
if [ -n "${NODEBASE_DL_URL:-}" ]; then
  SERVERS=("$NODEBASE_DL_URL")
fi
DL=""
for s in "${SERVERS[@]}"; do
  if VERSION=$(fetch "$s/version.txt" 2>/dev/null); then
    DL=$s
    break
  fi
done
if [ -z "$DL" ]; then
  echo "no download server reachable; check your network" >&2
  exit 1
fi

echo "installing nodebase $VERSION ($ASSET)"

TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT
echo "downloading $ASSET …"
fetch -o "$TMP/$ASSET" "$DL/$ASSET"
fetch -o "$TMP/SHA256SUMS" "$DL/SHA256SUMS"

# SHA256SUMS lists all platforms; verify just the one we downloaded. macOS
# ships shasum, Linux ships sha256sum.
cd "$TMP"
if command -v sha256sum >/dev/null; then
  grep " $ASSET\$" SHA256SUMS | sha256sum -c - >/dev/null
else
  grep " $ASSET\$" SHA256SUMS | shasum -a 256 -c - >/dev/null
fi
echo "checksum OK"

chmod 755 "$ASSET"
# /usr/local/bin may not exist on a fresh Apple Silicon Mac, and is usually
# root-owned; escalate only for the final placement so the download and
# verification never run as root.
SUDO=""
if [ ! -w "$INSTALL_DIR" ] || [ ! -d "$INSTALL_DIR" ]; then
  if [ "$(id -u)" -ne 0 ]; then
    SUDO="sudo"
    echo
    echo "placing nodebase into $INSTALL_DIR needs admin rights, so sudo may now ask"
    echo "for a password — that's this computer's own login password (nothing is"
    echo "sent anywhere; only this one file is installed)"
  fi
fi
$SUDO mkdir -p "$INSTALL_DIR"
$SUDO mv "$ASSET" "$INSTALL_DIR/nodebase"

echo
echo "installed: $INSTALL_DIR/nodebase ($("$INSTALL_DIR/nodebase" --version 2>/dev/null || echo "$VERSION"))"
echo
echo "next steps:"
echo "  1. nodebase login          # sign in — we'll email you a one-time code"
echo "  2. sudo nodebase connect   # join your workspace's private network"
echo "     (sudo asks for this computer's login password; creating the tunnel"
echo "      interface needs admin rights)"