#!/bin/sh
# Sondwave one-command installer (ADR-0047).
#
#   curl -fsSL https://get.sondwave.com | sh
#
# Detects your OS/arch, downloads the matching signed release, verifies its
# checksum, and installs a running, local-first Sondwave (loopback API + an
# auto-generated token). No prompts. Remote access and northbound delivery are
# a later, explicit step (`sudo sondwave-appliance expose`).
#
# Overrides (env):
#   SONDWAVE_VERSION   install an exact version (e.g. v0.1.0) instead of latest
#   SONDWAVE_BASE_URL  alternate download origin (default https://get.sondwave.com)
#   SONDWAVE_API_TOKEN use this bearer token instead of a generated one
set -eu

BASE_URL="${SONDWAVE_BASE_URL:-https://get.sondwave.com}"

log() { echo "sondwave: $*"; }
die() { echo "sondwave: error: $*" >&2; exit 1; }

# --- prerequisites -----------------------------------------------------------
if command -v curl >/dev/null 2>&1; then
  dl() { curl -fsSL "$1" -o "$2"; }
  dltext() { curl -fsSL "$1"; }
elif command -v wget >/dev/null 2>&1; then
  dl() { wget -qO "$2" "$1"; }
  dltext() { wget -qO- "$1"; }
else
  die "need curl or wget"
fi

if command -v sha256sum >/dev/null 2>&1; then
  verify_sum() { sha256sum -c "$1" >/dev/null; }
elif command -v shasum >/dev/null 2>&1; then
  verify_sum() { shasum -a 256 -c "$1" >/dev/null; }
else
  die "need sha256sum or shasum"
fi

[ "$(uname -s)" = "Linux" ] || die "Sondwave installs on Linux only (got $(uname -s))"
command -v systemctl >/dev/null 2>&1 || die "systemd is required"

case "$(uname -m)" in
  x86_64|amd64) ARCH=amd64 ;;
  aarch64|arm64) ARCH=arm64 ;;
  *) die "unsupported CPU architecture: $(uname -m)" ;;
esac

# --- resolve version ---------------------------------------------------------
VERSION="${SONDWAVE_VERSION:-}"
if [ -z "$VERSION" ]; then
  VERSION="$(dltext "$BASE_URL/dl/VERSION" | tr -d '[:space:]')" || die "cannot resolve latest version from $BASE_URL/dl/VERSION"
fi
case "$VERSION" in
  v[0-9]*) ;;
  *) die "invalid version: '$VERSION'" ;;
esac

NAME="sondwave-$VERSION-linux-$ARCH"
TARBALL="$NAME.tar.gz"
log "installing $VERSION for linux/$ARCH"

# --- download + verify -------------------------------------------------------
# Prefer disk-backed temp space: /tmp is a small tmpfs on low-RAM boxes (e.g. a
# 1 GB Pi caps it near 450 MB), and extracting ~100 MB of binaries there can hit
# ENOSPC. /var/tmp is disk-backed on a normal systemd Linux. Honor TMPDIR if set.
TMP="$(mktemp -d "${TMPDIR:-/var/tmp}/sondwave-install.XXXXXX")"
trap 'rm -rf "$TMP"' EXIT INT TERM
cd "$TMP"

dl "$BASE_URL/dl/$TARBALL" "$TARBALL" || die "download failed: $BASE_URL/dl/$TARBALL"
dl "$BASE_URL/dl/$TARBALL.sha256" "$TARBALL.sha256" || die "checksum download failed"
verify_sum "$TARBALL.sha256" || die "checksum verification failed for $TARBALL"
log "checksum verified"

tar -xzf "$TARBALL"
[ -d "$NAME" ] || die "unexpected archive layout"

# --- install (needs root) ----------------------------------------------------
SUDO=""
if [ "$(id -u)" != 0 ]; then
  command -v sudo >/dev/null 2>&1 || die "run as root, or install sudo"
  SUDO="sudo"
fi

cd "$NAME"
# Pass a caller-supplied token through the privileged step, if any.
if [ -n "${SONDWAVE_API_TOKEN:-}" ]; then
  exec $SUDO env "SONDWAVE_API_TOKEN=$SONDWAVE_API_TOKEN" ./local-install.sh
else
  exec $SUDO ./local-install.sh
fi