#!/usr/bin/env bash
#
# Install Daynivo Kiosk OS from the latest release, without git:
#
#   curl -fsSL https://daynivo.nl/kiosk/install.sh | sudo bash
#   curl -fsSL https://daynivo.nl/kiosk/install.sh | sudo bash -s -- --url "https://…" --name "Hal"
#
# Downloads the newest release from the Gitea repository, checks its SHA-256,
# unpacks it to /opt/daynivo-kiosk-os/<version> and runs its install.sh with
# the given options (see install.sh --help). Later updates come from the web
# interface (Systeem → Software-updates) or the same updater.

set -euo pipefail

API="${DAYNIVO_RELEASE_API:-https://git.rothman.nl/api/v1/repos/rothman/daynivo-kiosk-os/releases/latest}"
DEST=/opt/daynivo-kiosk-os

say() { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
die() { printf '\033[1;31mFout:\033[0m %s\n' "$*" >&2; exit 1; }

# Everything runs from main(), called on the last line: a download that breaks
# off halfway through this script runs nothing.
main() {
  [[ $EUID -eq 0 ]] || die "Voer dit uit met sudo (… | sudo bash)."
  for tool in curl python3 sha256sum tar; do
    command -v "$tool" >/dev/null || die "$tool ontbreekt."
  done

  say "Nieuwste release opzoeken"
  local json version tarball checksum
  json="$(curl -fsSL --proto '=https' "$API")" || die "Kan de releaseserver niet bereiken ($API)."
  read -r version tarball checksum < <(python3 -I -c '
import json, sys
data = json.loads(sys.stdin.read())
version = data["tag_name"].removeprefix("v")
assets = {a["name"]: a["browser_download_url"] for a in data.get("assets") or []}
name = f"daynivo-kiosk-os-{version}.tar.gz"
print(version, assets[name], assets[name + ".sha256"])
' <<<"$json") || die "De nieuwste release heeft geen installatiebestand."
  [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || die "Onbekend versienummer: $version"

  say "Daynivo Kiosk OS $version downloaden"
  local tmp
  tmp="$(mktemp -d)"
  trap 'rm -rf "$tmp"' EXIT
  curl -fsSL --proto '=https' -o "$tmp/release.tar.gz" "$tarball"
  curl -fsSL --proto '=https' -o "$tmp/release.sha256" "$checksum"
  local expected actual
  expected="$(awk '{print $1; exit}' "$tmp/release.sha256")"
  actual="$(sha256sum "$tmp/release.tar.gz" | awk '{print $1}')"
  [[ -n $expected && $expected == "$actual" ]] || die "Checksum klopt niet; er wordt niets geïnstalleerd."

  tar -C "$tmp" --no-same-owner -xzf "$tmp/release.tar.gz"
  [[ "$(tr -d '[:space:]' < "$tmp/daynivo-kiosk-os-$version/VERSION")" == "$version" ]] || die "Release bevat een andere versie."
  install -d -m 0755 "$DEST"
  rm -rf "${DEST:?}/$version"
  mv "$tmp/daynivo-kiosk-os-$version" "$DEST/$version"

  say "Installeren"
  "$DEST/$version/install.sh" "$@"
}

main "$@"