#!/bin/bash
# ==============================================================================
# Wallarm Deployment — Single Binary Bootstrap
# ==============================================================================
# Downloads the wallarm binary from the Git repository and places it in
# ~/deploy/.  One command to get started:
#
#   curl -fsSL ".../deploy.sh" | bash
#   sudo ./deploy/wallarm
#
# The binary handles everything: preflight → TUI wizard → deployment →
# dashboard with multi-node management.
# ==============================================================================

set -euo pipefail

BOLD='\033[1m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'

ARCH=$(uname -m)
case "$ARCH" in
    x86_64|amd64)  BIN_ARCH="amd64" ;;
    aarch64|arm64) BIN_ARCH="arm64" ;;
    *) echo -e "${RED}Unsupported architecture: $ARCH${NC}"; exit 1 ;;
esac

REPO="https://git.sechpoint.app"
REPO_PATH="customer-engineering/wallarm"
API_URL="${REPO}/api/v1/repos/${REPO_PATH}/releases"

# Fetch latest release info
echo -e "${YELLOW}Checking latest release...${NC}"
if command -v curl >/dev/null 2>&1; then
    RELEASE_JSON=$(curl -fsSL "${API_URL}?limit=1" 2>/dev/null)
elif command -v wget >/dev/null 2>&1; then
    RELEASE_JSON=$(wget -qO- "${API_URL}?limit=1" 2>/dev/null)
else
    echo -e "${RED}Neither curl nor wget found. Install one and re-run.${NC}"
    exit 1
fi

# Parse release tag and asset URL
RELEASE_TAG=$(echo "$RELEASE_JSON" | grep -o '"tag_name":"[^"]*"' | head -1 | cut -d'"' -f4)
if [[ -z "$RELEASE_TAG" ]]; then
    echo -e "${RED}No release found. Create a Gitea release first.${NC}"
    exit 1
fi

BIN_URL="${REPO}/api/v1/repos/${REPO_PATH}/releases/tags/${RELEASE_TAG}/assets"
echo -e "${GREEN}  Latest release: ${RELEASE_TAG}${NC}"

# Download the binary via release assets API
ASSETS_JSON=$(curl -fsSL "${REPO}/api/v1/repos/${REPO_PATH}/releases/tags/${RELEASE_TAG}" 2>/dev/null)
DOWNLOAD_URL=$(echo "$ASSETS_JSON" | grep -o "\"browser_download_url\":\"[^\"]*wallarm-linux-${BIN_ARCH}[^\"]*" | head -1 | cut -d'"' -f4)
DEPLOY_DIR="${HOME:-/root}/deploy"
BIN_PATH="${DEPLOY_DIR}/wallarm"

mkdir -p "$DEPLOY_DIR"

echo -e "${BOLD}Wallarm Deployment Bootstrap${NC}"
echo

# Download the binary
if [[ -z "$DOWNLOAD_URL" ]]; then
    echo -e "${RED}No linux-${BIN_ARCH} binary found in release ${RELEASE_TAG}.${NC}"
    echo -e "${YELLOW}Available assets:${NC}"
    echo "$ASSETS_JSON" | grep -o '"name":"[^"]*"' | cut -d'"' -f4
    exit 1
fi

echo -e "${YELLOW}Downloading wallarm (${RELEASE_TAG}, linux-${BIN_ARCH})...${NC}"
if command -v curl >/dev/null 2>&1; then
    curl -fsSL --progress-bar "$DOWNLOAD_URL" -o "$BIN_PATH"
elif command -v wget >/dev/null 2>&1; then
    wget -q --show-progress "$DOWNLOAD_URL" -O "$BIN_PATH"
else
    echo -e "${RED}Neither curl nor wget found. Install one and re-run.${NC}"
    exit 1
fi

chmod +x "$BIN_PATH"
echo -e "${GREEN}  Success: wallarm installed to ${BIN_PATH}${NC}"
echo

# Quick preflight (just to confirm binary works)
echo -e "${YELLOW}Testing binary...${NC}"
if "$BIN_PATH" --version 2>/dev/null; then
    echo -e "${GREEN}  Binary OK${NC}"
else
    echo -e "${RED}  Binary verification failed${NC}"
    exit 1
fi
echo

echo -e "${GREEN}${BOLD}Ready!${NC}"
echo
echo -e "  ${CYAN}sudo ${BIN_PATH}${NC}     — Start the TUI (wizard on first run, dashboard after)"
echo -e "  ${CYAN}${BIN_PATH} --help${NC}   — Show all commands"
echo -e "  ${CYAN}${BIN_PATH} --tunnel${NC} — Start remote access tunnel"