#!/usr/bin/env bash

if [ -z "${BASH_VERSION:-}" ]; then
  exec /usr/bin/env bash "$0" "$@"
fi

set -euo pipefail

CLOUD_URL="https://api.kidguard.fromcloud.de"
INSTALL_URL="https://install.kidguard.fromcloud.de/bootstrap-v1.sh"
WORK_DIR=""
SETUP_SECRET=""

cleanup() {
  unset SETUP_SECRET SECRET_HASH ENROLLMENT_TOKEN_HASH KID_GUARD_SETUP_SECRET
  if [[ -n "${WORK_DIR}" ]]; then
    rm -rf -- "${WORK_DIR}"
  fi
}
trap cleanup EXIT

if [[ "${EUID}" -ne 0 ]]; then
  echo 'Bitte starte die heruntergeladene Datei mit:' >&2
  echo 'sudo bash "$HOME/Downloads/KidGuard-Setup.sh"' >&2
  exit 1
fi

if [[ ! -r /etc/os-release ]]; then
  echo "Dieses Linux-System wird noch nicht unterstützt." >&2
  exit 1
fi
. /etc/os-release
case "${ID:-}" in
  ubuntu|debian|linuxmint) ;;
  *)
    echo "Unterstützt werden Ubuntu, Debian und Linux Mint. Gefunden: ${PRETTY_NAME:-unbekannt}" >&2
    exit 1
    ;;
esac

echo "KidGuard Setup für ${PRETTY_NAME:-Linux}"
echo "Voraussetzungen werden sicher geprüft ..."
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y --no-install-recommends ca-certificates curl openssl python3

WORK_DIR="$(mktemp -d /tmp/kidguard-device-setup.XXXXXX)"
chmod 0700 "${WORK_DIR}"
SETUP_SECRET="$(openssl rand -hex 32)"
SECRET_HASH="$(printf '%s' "${SETUP_SECRET}" | sha256sum | cut -d ' ' -f 1)"
ENROLLMENT_TOKEN_HASH="$(printf 'KGS1-%s' "${SETUP_SECRET}" | sha256sum | cut -d ' ' -f 1)"
curl -fsS -X POST \
  -H "Content-Type: application/json" \
  -d "{\"secret_hash\":\"${SECRET_HASH}\",\"enrollment_token_hash\":\"${ENROLLMENT_TOKEN_HASH}\"}" \
  "${CLOUD_URL}/api/client/setups" > "${WORK_DIR}/setup.json"
chmod 0600 "${WORK_DIR}/setup.json"

readarray -t SETUP_VALUES < <(
  python3 - "${WORK_DIR}/setup.json" <<'PY'
import json
import re
import sys
from pathlib import Path

data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))["setup"]
setup_id = str(data["id"])
code = str(data["pairing_code"])
expires_ts = int(data["expires_ts"])
if not re.fullmatch(r"[a-f0-9]{32}", setup_id):
    raise SystemExit("invalid setup id")
if not re.fullmatch(r"KGD-[A-HJ-NP-Z2-9]{4}(?:-[A-HJ-NP-Z2-9]{4}){2}", code):
    raise SystemExit("invalid pairing code")
print(setup_id)
print(code)
print(expires_ts)
PY
)

SETUP_ID="${SETUP_VALUES[0]}"
PAIRING_CODE="${SETUP_VALUES[1]}"
EXPIRES_TS="${SETUP_VALUES[2]}"
rm -f -- "${WORK_DIR}/setup.json"

echo
echo "============================================================"
echo "  Dein KidGuard-Kopplungscode: ${PAIRING_CODE}"
echo "============================================================"
echo
echo "Öffne jetzt das KidGuard Family Board auf dem Elterngerät,"
echo "klicke auf 'Gerät hinzufügen' und gib diesen Code dort ein."
echo "Der Code läuft nach 15 Minuten ab. Dieses Terminal offen lassen."

while true; do
  if (( $(date +%s) > EXPIRES_TS )); then
    echo "Der Kopplungscode ist abgelaufen. Bitte starte das Setup erneut." >&2
    exit 1
  fi
  sleep 3
  if ! curl -fsS \
    -H "X-KidGuard-Setup: ${SETUP_ID}" \
    -H "Authorization: Bearer ${SETUP_SECRET}" \
    "${CLOUD_URL}/api/client/setups/${SETUP_ID}" > "${WORK_DIR}/status.json"; then
    continue
  fi
  SETUP_STATE="$(python3 - "${WORK_DIR}/status.json" <<'PY'
import json
import sys
from pathlib import Path
print(str(json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))["setup"]["state"]))
PY
)"
  if [[ "${SETUP_STATE}" == "claimed" ]]; then
    break
  fi
  if [[ "${SETUP_STATE}" == "expired" || "${SETUP_STATE}" == "used" ]]; then
    echo "Diese Kopplung ist abgelaufen oder wurde bereits verwendet." >&2
    exit 1
  fi
done

echo "✓ Elternkonto hat diesen Code bestätigt."
echo "Der signierte KidGuard-Client wird jetzt geladen und installiert ..."
curl -fsSLo "${WORK_DIR}/kidguard-install.sh" "${INSTALL_URL}"
KID_GUARD_SETUP_SECRET="${SETUP_SECRET}" \
  bash "${WORK_DIR}/kidguard-install.sh" --setup-id "${SETUP_ID}"