#!/usr/bin/env bash
set -euo pipefail

BASE_URL="https://workbench-cli.oss-cn-hangzhou.aliyuncs.com"
INSTALL_DIR="/usr/local/bin"
VERSION=""

# --- Parse arguments ---
while [ $# -gt 0 ]; do
    case "$1" in
        -v|--version) VERSION="$2"; shift 2 ;;
        -d|--dir)     INSTALL_DIR="$2"; shift 2 ;;
        -h|--help)
            echo "Usage: install.sh [-v VERSION] [-d INSTALL_DIR]"
            echo ""
            echo "Options:"
            echo "  -v, --version VERSION   Install a specific version (default: latest)"
            echo "  -d, --dir DIR           Installation directory (default: /usr/local/bin)"
            echo ""
            echo "Examples:"
            echo "  curl -fsSL ${BASE_URL}/install.sh | bash"
            echo "  curl -fsSL ${BASE_URL}/install.sh | bash -s -- -v v1.0.0"
            exit 0
            ;;
        *) echo "Unknown option: $1"; exit 1 ;;
    esac
done

# --- Normalize and validate version format ---
if [ -n "$VERSION" ]; then
    # Auto-add 'v' prefix if missing
    case "$VERSION" in
        v*) ;;
        *)  VERSION="v${VERSION}" ;;
    esac
    # Validate: vMAJOR.MINOR.PATCH[-prerelease]
    if ! echo "$VERSION" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
        echo "Error: invalid version format '${VERSION}'"
        echo "Expected: vMAJOR.MINOR.PATCH[-prerelease] (e.g. v1.0.0, v0.1.7-beta)"
        exit 1
    fi
fi

# --- Detect OS ---
case "$(uname -s)" in
    Darwin)  OS="darwin"  ;;
    Linux)   OS="linux"   ;;
    MINGW*|MSYS*|CYGWIN*)
        echo "========================================="
        echo "  Windows is not supported by this script."
        echo ""
        echo "  Please download the zip manually:"
        echo "    ${BASE_URL}/latest/workbench-windows-amd64.zip"
        echo ""
        echo "  Then extract workbench.exe and add it to your PATH."
        echo "========================================="
        exit 1
        ;;
    *)
        echo "Error: unsupported OS: $(uname -s)"
        exit 1
        ;;
esac

# --- Detect Arch ---
case "$(uname -m)" in
    x86_64|amd64)   ARCH="amd64" ;;
    aarch64|arm64)   ARCH="arm64" ;;
    *)
        echo "Error: unsupported architecture: $(uname -m)"
        exit 1
        ;;
esac

# --- Resolve download URL ---
if [ -z "$VERSION" ]; then
    URL_PREFIX="${BASE_URL}/latest"
else
    URL_PREFIX="${BASE_URL}/releases/${VERSION}"
fi

ARCHIVE="workbench-${OS}-${ARCH}.tar.gz"
ARCHIVE_URL="${URL_PREFIX}/${ARCHIVE}"
CHECKSUM_URL="${URL_PREFIX}/checksums.sha256"

echo "Installing workbench (${OS}/${ARCH})"
if [ -n "$VERSION" ]; then
    echo "  version: ${VERSION}"
else
    echo "  version: latest"
fi
echo "  to:      ${INSTALL_DIR}/workbench"
echo ""

# --- Create temp dir ---
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT

# --- Download archive ---
echo "Downloading ${ARCHIVE}..."
if ! curl -fSL --progress-bar -o "${TMP_DIR}/${ARCHIVE}" "${ARCHIVE_URL}"; then
    echo ""
    echo "Error: failed to download ${ARCHIVE_URL}"
    if [ -n "$VERSION" ]; then
        echo "Check that version '${VERSION}' exists."
    fi
    exit 1
fi

# --- Download and verify checksum ---
echo "Verifying checksum..."
if ! curl -fsSL -o "${TMP_DIR}/checksums.sha256" "${CHECKSUM_URL}" 2>/dev/null; then
    echo ""
    echo "Error: could not download checksums from ${CHECKSUM_URL}"
    echo "Refusing to install unverified binary."
    exit 1
fi

EXPECTED=$(grep "${ARCHIVE}" "${TMP_DIR}/checksums.sha256" | awk '{print $1}')
if [ -z "$EXPECTED" ]; then
    echo ""
    echo "Error: archive '${ARCHIVE}' not found in checksums file."
    echo "Refusing to install unverified binary."
    exit 1
fi

if command -v sha256sum &>/dev/null; then
    ACTUAL=$(sha256sum "${TMP_DIR}/${ARCHIVE}" | awk '{print $1}')
elif command -v shasum &>/dev/null; then
    ACTUAL=$(shasum -a 256 "${TMP_DIR}/${ARCHIVE}" | awk '{print $1}')
else
    echo ""
    echo "Error: neither sha256sum nor shasum found on this system."
    echo "Refusing to install unverified binary. Please install one of these tools."
    exit 1
fi

if [ "$ACTUAL" != "$EXPECTED" ]; then
    echo "Error: checksum mismatch!"
    echo "  expected: ${EXPECTED}"
    echo "  actual:   ${ACTUAL}"
    exit 1
fi
echo "  checksum OK"

# --- Extract ---
echo "Extracting..."
tar xzf "${TMP_DIR}/${ARCHIVE}" -C "${TMP_DIR}"

# Find the binary (inside workbench-{os}-{arch}/ directory)
EXTRACTED="${TMP_DIR}/workbench-${OS}-${ARCH}/workbench"
if [ ! -f "$EXTRACTED" ]; then
    # Fallback: try flat extraction
    EXTRACTED="${TMP_DIR}/workbench"
fi
if [ ! -f "$EXTRACTED" ]; then
    echo "Error: could not find workbench binary in archive"
    exit 1
fi

# --- Install ---
mkdir -p "$INSTALL_DIR" 2>/dev/null || true

if [ -w "$INSTALL_DIR" ]; then
    cp "$EXTRACTED" "${INSTALL_DIR}/workbench"
    chmod +x "${INSTALL_DIR}/workbench"
else
    echo "  (requires sudo)"
    sudo cp "$EXTRACTED" "${INSTALL_DIR}/workbench"
    sudo chmod +x "${INSTALL_DIR}/workbench"
fi

# --- macOS: re-sign and clear quarantine to prevent Gatekeeper killing the process ---
if [ "$OS" = "darwin" ]; then
    TARGET="${INSTALL_DIR}/workbench"
    if [ -w "$INSTALL_DIR" ]; then
        codesign --force --sign - "$TARGET" 2>/dev/null || true
        xattr -d com.apple.quarantine "$TARGET" 2>/dev/null || true
    else
        sudo codesign --force --sign - "$TARGET" 2>/dev/null || true
        sudo xattr -d com.apple.quarantine "$TARGET" 2>/dev/null || true
    fi
fi

echo ""
"${INSTALL_DIR}/workbench" version
echo ""
echo "Done. Run 'workbench' to get started."