#!/usr/bin/env bash

set -Eeuo pipefail

readonly ROOT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"
readonly RELEASE_JSON="$ROOT_DIR/release.json"
readonly INSTALL_ROOT="${NRUNNER_INSTALL_ROOT:-/opt/nrunner}"
readonly CONFIG_ROOT="${NRUNNER_CONFIG_DIR:-/etc/nrunner}"

[[ "$(id -u)" -eq 0 ]] || { echo "Run with sudo: sudo ./scripts/install-updater" >&2; exit 1; }
[[ -x "$ROOT_DIR/bin/nrunner-updater" ]] || { echo "Updater binary is missing" >&2; exit 1; }
[[ -f "$ROOT_DIR/updater/release-public-key.pem" ]] || { echo "Release public key is missing" >&2; exit 1; }
[[ -f "$RELEASE_JSON" ]] || { echo "release.json is missing" >&2; exit 1; }

version="$(sed -n 's/^[[:space:]]*"version":[[:space:]]*"\([^"]*\)".*/\1/p' "$RELEASE_JSON" | head -n1)"
[[ "$version" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Invalid release version" >&2; exit 1; }
release_dir="$INSTALL_ROOT/releases/$version"

install -d -m 0755 "$INSTALL_ROOT/releases" "$CONFIG_ROOT" /etc/nrunner-updater /run/nrunner-updater
if [[ "$ROOT_DIR" != "$release_dir" ]]; then
  if [[ ! -e "$release_dir" ]]; then
    cp -a -- "$ROOT_DIR" "$release_dir"
    # Database snapshots have an independent lifecycle and must not be copied
    # into immutable application releases.
    rm -f -- \
      "$release_dir/data/vulndb/vulndb.dump" \
      "$release_dir/data/vulndb/vulndb.dump.sha256"
  fi
fi

for pair in \
  "config/server.env:server.env" \
  "config/client.env:client.env" \
  "config/vulndb.env:vulndb.env"; do
  relative="${pair%%:*}"
  name="${pair#*:}"
  [[ -f "$release_dir/$relative" ]] || { echo "Missing configuration: $relative" >&2; exit 1; }
  if [[ ! -f "$CONFIG_ROOT/$name" ]]; then
    install -m 0600 "$release_dir/$relative" "$CONFIG_ROOT/$name"
  fi
  rm -f -- "$release_dir/$relative"
  ln -s "$CONFIG_ROOT/$name" "$release_dir/$relative"
done

install -m 0755 "$ROOT_DIR/bin/nrunner-updater" /usr/local/sbin/nrunner-updater
install -m 0644 "$ROOT_DIR/updater/release-public-key.pem" /etc/nrunner-updater/release-public-key.pem
install -m 0644 "$ROOT_DIR/updater/nrunner-updater.service" /etc/systemd/system/nrunner-updater.service
ln -sfn "$release_dir" "$INSTALL_ROOT/current.new"
mv -Tf "$INSTALL_ROOT/current.new" "$INSTALL_ROOT/current"
systemctl daemon-reload
systemctl enable --now nrunner-updater.service

for _ in {1..20}; do
  [[ -S /run/nrunner-updater/updater.sock ]] && break
  sleep 1
done
if [[ ! -S /run/nrunner-updater/updater.sock ]]; then
  systemctl status nrunner-updater.service --no-pager --full || true
  journalctl --unit nrunner-updater.service --no-pager --lines=50 || true
  exit 1
fi

echo "Nrunner updater installed; managed release: $version"
