#!/usr/bin/env bash
set -Eeuo pipefail

BOOTSTRAP_VERSION="3"
BASE_URL="${VIDALFOOD_BOOTSTRAP_BASE_URL:-https://install.vidal.food/releases}"
CHANNEL="${VIDALFOOD_BOOTSTRAP_CHANNEL:-latest}"
DEFAULT_DOMAIN="${VIDALFOOD_BOOTSTRAP_DOMAIN:-vidal.food}"

log() { printf '[vidalfood-bootstrap] %s\n' "$*" >&2; }
die() { log "ERRO: $*"; exit 1; }

[[ "${EUID}" -eq 0 ]] || die "execute com sudo/root (ex.: curl -fsSL https://install.vidal.food | sudo bash)."
for cmd in curl sha256sum tar mktemp grep awk; do command -v "$cmd" >/dev/null 2>&1 || die "comando obrigatório ausente: $cmd"; done
[[ "$BASE_URL" == https://* ]] || die "VIDALFOOD_BOOTSTRAP_BASE_URL deve usar HTTPS."
[[ "$BASE_URL" != *$'\n'* && "$BASE_URL" != *$'\r'* ]] || die "URL de bootstrap inválida."
[[ "$CHANNEL" =~ ^[A-Za-z0-9._-]{1,64}$ ]] || die "canal de bootstrap inválido."
[[ "$DEFAULT_DOMAIN" =~ ^[A-Za-z0-9][A-Za-z0-9.-]*\.[A-Za-z]{2,}$ ]] || die "VIDALFOOD_BOOTSTRAP_DOMAIN inválido."

work="$(mktemp -d)"
trap 'rm -rf "$work"' EXIT

log "Resolvendo release do canal ${CHANNEL}..."
curl -fsSL --proto '=https' --tlsv1.2 --connect-timeout 10 --max-time 30 \
  "${BASE_URL}/${CHANNEL}" -o "${work}/release-ref"
release_ref="$(tr -d '\r\n ' < "${work}/release-ref")"
[[ "$release_ref" =~ ^[0-9a-f]{40}$ ]] || die "ponteiro de release inválido; esperado SHA Git de 40 caracteres."

archive="vidalfood-install-${release_ref}.tar.gz"
checksum="${archive}.sha256"
log "Baixando VidalFood Install ${release_ref}..."
curl -fsSL --proto '=https' --tlsv1.2 --connect-timeout 10 --max-time 180 \
  "${BASE_URL}/${archive}" -o "${work}/${archive}"
curl -fsSL --proto '=https' --tlsv1.2 --connect-timeout 10 --max-time 30 \
  "${BASE_URL}/${checksum}" -o "${work}/${checksum}"

expected_line="$(cat "${work}/${checksum}")"
[[ "$expected_line" =~ ^[0-9a-f]{64}[[:space:]][[:space:]]vidalfood-install-${release_ref}\.tar\.gz$ ]] \
  || die "arquivo de checksum possui formato inesperado."
(
  cd "$work"
  sha256sum -c "$checksum" >/dev/null
) || die "SHA-256 do pacote não confere; nada foi executado."

if tar -tzf "${work}/${archive}" | awk 'BEGIN{bad=0} /^\//{bad=1} /(^|\/)\.\.($|\/)/{bad=1} END{exit bad?0:1}'; then
  die "pacote contém caminho inseguro."
fi

tar -xzf "${work}/${archive}" -C "$work"
root="${work}/vidalfood-install-${release_ref}"
[[ -d "$root" ]] || die "diretório raiz esperado ausente no pacote."
[[ -f "${root}/RELEASE-MANIFEST" ]] || die "manifesto da release ausente."
manifest_ref="$(sed -n 's/^commit=//p' "${root}/RELEASE-MANIFEST" | head -n1)"
[[ "$manifest_ref" == "$release_ref" ]] || die "manifesto não corresponde ao SHA resolvido."
[[ -f "${root}/install.sh" && -f "${root}/cli/vidalfood" && -f "${root}/scripts/one-command-install.sh" ]] || die "pacote de instalação incompleto."
[[ ! -e "${root}/.env" ]] || die "pacote público contém .env inesperado."

log "Pacote validado por SHA-256. Executando instalador oficial..."
cd "$root"
if (($# == 0)); then
  log "Modo padrão: fluxo único da primeira VPS para ${DEFAULT_DOMAIN}."
  exec bash ./scripts/one-command-install.sh --domain "$DEFAULT_DOMAIN"
fi
if [[ "${1:-}" == "--one-command" ]]; then
  shift
  exec bash ./scripts/one-command-install.sh --domain "$DEFAULT_DOMAIN" "$@"
fi
# Advanced/manual modes remain available for operators.
exec bash ./install.sh "$@"