#!/bin/bash
set -e

REPO="Portabase/cli"
INSTALL_DIR="/usr/local/bin"
BIN_NAME="portabase"

GREEN='\033[0;32m'
RED='\033[0;31m'
BLUE='\033[0;34m'
YELLOW='\033[1;33m'
NC='\033[0m'

VERSION_REGEX='[0-9]+\.[0-9]+\.[0-9]+([abrc]+[0-9]*)?'

CURRENT_VERSION="0.0.0"
if command -v $BIN_NAME >/dev/null 2>&1; then
    CURRENT_VERSION=$($BIN_NAME --version | grep -oE "$VERSION_REGEX" | head -n1)
fi

LATEST_REL_JSON=$(curl -s "https://api.github.com/repos/${REPO}/releases/latest")
LATEST_TAG=$(echo "$LATEST_REL_JSON" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
LATEST_VERSION=$(echo "$LATEST_TAG" | grep -oE "$VERSION_REGEX")

if [ -z "$LATEST_VERSION" ]; then
    echo -e "${RED}Error: Could not fetch remote version${NC}"
    exit 1
fi

if [ "$CURRENT_VERSION" = "$LATEST_VERSION" ]; then
    echo -e "${GREEN}Portabase is already up to date (v$CURRENT_VERSION)${NC}"
    exit 0
fi

if [ "$CURRENT_VERSION" != "0.0.0" ]; then
    HIGHER_VERSION=$(printf "$CURRENT_VERSION\n$LATEST_VERSION" | sort -V | tail -n1)
    if [ "$HIGHER_VERSION" = "$CURRENT_VERSION" ]; then
        echo -e "${YELLOW}Local version v$CURRENT_VERSION is newer than remote v$LATEST_VERSION${NC}"
        exit 0
    fi
    echo -e "${BLUE}Updating ${BIN_NAME}: v$CURRENT_VERSION -> v$LATEST_VERSION${NC}"
else
    echo -e "${BLUE}Installing Portabase CLI v$LATEST_VERSION...${NC}"
fi

OS_RAW=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH_RAW=$(uname -m)

case "$OS_RAW" in
    darwin) OS="macos" ;;
    linux)  OS="linux" ;;
    *) echo -e "${RED}Unsupported OS: $OS_RAW${NC}"; exit 1 ;;
esac

case "$ARCH_RAW" in
    x86_64) ARCH="amd64" ;;
    arm64|aarch64) ARCH="arm64" ;;
    *) echo -e "${RED}Unsupported Architecture: $ARCH_RAW${NC}"; exit 1 ;;
esac

BINARY_NAME="portabase_${OS}_${ARCH}"
BASE_URL="https://github.com/${REPO}/releases/download/${LATEST_TAG}"
TMP_DIR=$(mktemp -d)

trap 'rm -rf "$TMP_DIR"' EXIT

curl -sSL -o "$TMP_DIR/$BINARY_NAME" "${BASE_URL}/${BINARY_NAME}"
curl -sSL -o "$TMP_DIR/checksums.txt" "${BASE_URL}/checksums.txt"

EXPECTED_HASH=$(grep "$BINARY_NAME" "$TMP_DIR/checksums.txt" | awk '{print $1}')

if [ -z "$EXPECTED_HASH" ]; then
    echo -e "${RED}Error: Checksum not found for $BINARY_NAME${NC}"
    exit 1
fi

if command -v sha256sum >/dev/null; then
    ACTUAL_HASH=$(sha256sum "$TMP_DIR/$BINARY_NAME" | awk '{print $1}')
else
    ACTUAL_HASH=$(shasum -a 256 "$TMP_DIR/$BINARY_NAME" | awk '{print $1}')
fi

if [ "$ACTUAL_HASH" != "$EXPECTED_HASH" ]; then
    echo -e "${RED}CRITICAL: Integrity check failed!${NC}"
    exit 1
fi

chmod +x "$TMP_DIR/$BINARY_NAME"
if [ ! -d "$INSTALL_DIR" ]; then sudo mkdir -p "$INSTALL_DIR"; fi

if sudo mv "$TMP_DIR/$BINARY_NAME" "$INSTALL_DIR/$BIN_NAME"; then
    if [ "$OS" = "macos" ]; then
        sudo xattr -rd com.apple.quarantine "$INSTALL_DIR/$BIN_NAME" 2>/dev/null || true
    fi
    echo -e "${GREEN}Portabase CLI v$LATEST_VERSION successfully installed${NC}"
else
    echo -e "${RED}Error: Failed to install binary${NC}"
    exit 1
fi