#!/usr/bin/env bash
set -euo pipefail

usage() {
  cat <<'EOF'
Usage:
  bash install.sh --profile personal
  bash install.sh --profile company

Options:
  --profile NAME     Machine profile type: personal or company.
  --identity ITEM    Use a specific 1Password identity item ID or title.
  --base-url URL     Installer host. Defaults to https://mac.gyorffy.dev.
  --keep             Keep the downloaded seed directory after the run.
  --dry-run          Download, verify, and unpack the seed without running bootstrap.sh.
  -h, --help         Show this help.
EOF
}

profile=""
identity=""
identity_explicit=0
base_url="https://mac.gyorffy.dev"
keep=0
dry_run=0

while [[ $# -gt 0 ]]; do
  case "$1" in
    --profile)
      if [[ $# -lt 2 || "${2:-}" == --* ]]; then
        echo "--profile requires a profile name." >&2
        exit 2
      fi
      profile="${2:-}"
      shift 2
      ;;
    --identity)
      if [[ $# -lt 2 || "${2:-}" == --* ]]; then
        echo "--identity requires a non-empty 1Password item ID or title." >&2
        exit 2
      fi
      identity="${2:-}"
      identity_explicit=1
      shift 2
      ;;
    --base-url)
      if [[ $# -lt 2 || "${2:-}" == --* ]]; then
        echo "--base-url requires a URL." >&2
        exit 2
      fi
      base_url="${2:-}"
      shift 2
      ;;
    --keep)
      keep=1
      shift
      ;;
    --dry-run)
      dry_run=1
      keep=1
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "Unknown argument: $1" >&2
      usage >&2
      exit 2
      ;;
  esac
done

if [[ -z "$profile" ]]; then
  usage >&2
  exit 2
fi

case "$profile" in
  personal|company) ;;
  *)
    echo "Unsupported profile: $profile" >&2
    exit 2
    ;;
esac

if [[ "$identity_explicit" -eq 1 && -z "$identity" ]]; then
  echo "--identity requires a non-empty 1Password item ID or title." >&2
  exit 2
fi

for tool in curl shasum unzip; do
  if ! command -v "$tool" >/dev/null 2>&1; then
    echo "Required tool is missing: $tool" >&2
    exit 1
  fi
done

workdir="$(mktemp -d "${TMPDIR:-/tmp}/mac-bootstrap.XXXXXX")"

cleanup() {
  status=$?
  if [[ "$keep" -eq 1 || "$status" -ne 0 ]]; then
    echo "Seed directory kept at: $workdir" >&2
  else
    rm -rf "$workdir"
  fi
}
trap cleanup EXIT

seed_ready=0
for attempt in 1 2 3; do
  cache_buster="attempt=${attempt}&t=$(date +%s)"
  echo "Downloading seed bundle from $base_url"

  if curl -fsSL "$base_url/mac-bootstrap-seed.zip?$cache_buster" -o "$workdir/mac-bootstrap-seed.zip" &&
    curl -fsSL "$base_url/mac-bootstrap-seed.zip.sha256?$cache_buster" -o "$workdir/mac-bootstrap-seed.zip.sha256" &&
    (
      cd "$workdir"
      echo "Verifying seed checksum"
      shasum -a 256 -c mac-bootstrap-seed.zip.sha256
    ); then
    seed_ready=1
    break
  fi

  if [[ "$attempt" -lt 3 ]]; then
    echo "Seed download or checksum verification failed. Retrying."
    sleep 2
  fi
done

if [[ "$seed_ready" -ne 1 ]]; then
  echo "Seed download failed after multiple attempts." >&2
  exit 1
fi

echo "Unpacking seed bundle"
unzip -q "$workdir/mac-bootstrap-seed.zip" -d "$workdir"

chmod +x "$workdir/mac-bootstrap/bootstrap.sh"

if [[ "$dry_run" -eq 1 ]]; then
  echo "Dry run complete. Seed bundle unpacked successfully."
  exit 0
fi

bootstrap_args=(--profile "$profile")
if [[ "$identity_explicit" -eq 1 ]]; then
  bootstrap_args+=(--identity "$identity")
fi

"$workdir/mac-bootstrap/bootstrap.sh" "${bootstrap_args[@]}"