#!/usr/bin/env bash
# Selfwipe installer. Read before running as root.
# Downloaded executables are verified against the HTTPS release checksum list.
set -euo pipefail
server="https://selfwipe.mattmade.ai"
while [[ $# -gt 0 ]]; do
  case "$1" in
    --server) server="${2:?missing HTTPS server origin}"; shift 2 ;;
    *) printf 'Usage: install.sh [--server https://selfwipe.mattmade.ai]\n' >&2; exit 1 ;;
  esac
done
if [[ ! "$server" =~ ^https://[A-Za-z0-9.-]+(:[0-9]+)?$ ]]; then printf 'Server must be an HTTPS origin.\n' >&2; exit 1; fi
if [[ "$(id -u)" != 0 ]]; then printf 'Run this installer with sudo.\n' >&2; exit 1; fi
case "$(uname -s)" in
  Darwin) platform=darwin; state_dir='/Library/Application Support/Selfwipe' ;;
  Linux) platform=linux; state_dir=/var/lib/selfwipe; command -v systemctl >/dev/null || { printf 'Linux installation requires systemd.\n' >&2; exit 1; } ;;
  *) printf 'Supported platforms: macOS and Linux. Windows uses install.ps1.\n' >&2; exit 1 ;;
esac
case "$(uname -m)" in arm64|aarch64) arch=arm64 ;; x86_64|amd64) arch=amd64 ;; *) printf 'Unsupported processor architecture.\n' >&2; exit 1 ;; esac
artifact="selfwipe-agent-$platform-$arch"
work_dir="$(mktemp -d)"
trap 'rm -rf "$work_dir"' EXIT
curl --fail --silent --show-error --proto '=https' --tlsv1.2 "$server/downloads/$artifact" -o "$work_dir/$artifact"
curl --fail --silent --show-error --proto '=https' --tlsv1.2 "$server/downloads/SHA256SUMS" -o "$work_dir/SHA256SUMS"
expected="$(awk -v name="$artifact" '$2 == name {print $1}' "$work_dir/SHA256SUMS")"
if command -v shasum >/dev/null; then actual="$(shasum -a 256 "$work_dir/$artifact" | awk '{print $1}')"; else actual="$(sha256sum "$work_dir/$artifact" | awk '{print $1}')"; fi
if [[ ${#expected} != 64 || "$expected" != "$actual" ]]; then printf 'Release checksum verification failed.\n' >&2; exit 1; fi
if [[ "$platform" == darwin ]]; then
  launchctl bootout system/ai.mattmade.selfwipe >/dev/null 2>&1 || true
else
  systemctl stop selfwipe.service >/dev/null 2>&1 || true
fi
install -d -m 0755 /usr/local/bin
install -m 0755 "$work_dir/$artifact" /usr/local/bin/selfwipe-agent
install -d -m 0700 "$state_dir"
if [[ ! -f "$state_dir/device.json" ]]; then /usr/local/bin/selfwipe-agent enroll --server "$server"; fi
if [[ "$platform" == darwin ]]; then
  cat > /Library/LaunchDaemons/ai.mattmade.selfwipe.plist <<'PLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
<key>Label</key><string>ai.mattmade.selfwipe</string>
<key>ProgramArguments</key><array><string>/usr/local/bin/selfwipe-agent</string><string>run</string></array>
<key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
<key>ThrottleInterval</key><integer>15</integer>
<key>StandardOutPath</key><string>/var/log/selfwipe.log</string>
<key>StandardErrorPath</key><string>/var/log/selfwipe.log</string>
</dict></plist>
PLIST
  chmod 0644 /Library/LaunchDaemons/ai.mattmade.selfwipe.plist
  chown root:wheel /Library/LaunchDaemons/ai.mattmade.selfwipe.plist
  launchctl bootstrap system /Library/LaunchDaemons/ai.mattmade.selfwipe.plist
else
  cat > /etc/systemd/system/selfwipe.service <<'UNIT'
[Unit]
Description=Selfwipe enrolled device agent
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
ExecStart=/usr/local/bin/selfwipe-agent run
Restart=on-failure
RestartSec=15
UMask=0077
ProtectHome=read-only
PrivateTmp=true
[Install]
WantedBy=multi-user.target
UNIT
  # Native post-wake hook requests an immediate check from the running service.
  install -d -m 0755 /usr/lib/systemd/system-sleep
  cat > /usr/lib/systemd/system-sleep/selfwipe <<'HOOK'
#!/bin/sh
if [ "$1" = post ]; then /usr/local/bin/selfwipe-agent check; fi
HOOK
  chmod 0755 /usr/lib/systemd/system-sleep/selfwipe
  systemctl daemon-reload
  systemctl enable --now selfwipe.service
fi
printf '\nSelfwipe installed. Approve the enrollment above, then use the dashboard to run a simulation.\n'
printf 'Check status: sudo selfwipe-agent status\n'
printf 'Real erasure is disabled until a supported adapter is explicitly armed locally.\n'