#!/usr/bin/env bash
set -euo pipefail

SERVER='https://staging.demo.stratacos.net'
ENROLLMENT_TOKEN='b6CUhR1HxhjIZgNQ94F8UY9z_aCQJL-yueKJcw8NZk8'
MODE='permanent'
NAME=''
PYTHON="python3"
INSTALL_DIR="/opt/stratacos-agent"
START_NOW=0

usage() {
  cat <<'EOF'
Usage: sudo ./install-agent.sh --server URL --enrollment-token TOKEN [options]

Options:
  --mode permanent|ephemeral   Permanent systemd service or temporary state (default: permanent)
  --name NAME                  Friendly agent name
  --python PATH                Python executable (default: python3)
  --install-dir PATH           Agent code directory (default: /opt/stratacos-agent)
  --start-now                  Start the agent immediately after installation
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --server) SERVER="${2:?Missing value for --server}"; shift 2 ;;
    --enrollment-token) ENROLLMENT_TOKEN="${2:?Missing value for --enrollment-token}"; shift 2 ;;
    --mode) MODE="${2:?Missing value for --mode}"; shift 2 ;;
    --name) NAME="${2:?Missing value for --name}"; shift 2 ;;
    --python) PYTHON="${2:?Missing value for --python}"; shift 2 ;;
    --install-dir) INSTALL_DIR="${2:?Missing value for --install-dir}"; shift 2 ;;
    --start-now) START_NOW=1; shift ;;
    -h|--help) usage; exit 0 ;;
    *) echo "Unknown option: $1" >&2; usage; exit 2 ;;
  esac
done

if [[ -z "$SERVER" ]]; then
  read -r -p "Dashboard server URL: " SERVER
fi
if [[ -z "$ENROLLMENT_TOKEN" ]]; then
  read -r -s -p "Enrollment token: " ENROLLMENT_TOKEN
  printf '\n'
fi
[[ -n "$SERVER" && -n "$ENROLLMENT_TOKEN" ]] || { usage; exit 2; }
[[ "$MODE" == "permanent" || "$MODE" == "ephemeral" ]] || { echo "--mode must be permanent or ephemeral" >&2; exit 2; }
[[ "$(id -u)" -eq 0 ]] || { echo "Run this installer with sudo/root privileges." >&2; exit 1; }
command -v "$PYTHON" >/dev/null || { echo "Python executable not found: $PYTHON" >&2; exit 1; }

SOURCE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
if [[ "$MODE" == "permanent" ]]; then
  DATA_DIR="/var/lib/stratacos-agent"
  CONFIG_DIR="$DATA_DIR"
else
  DATA_DIR="$(mktemp -d /tmp/stratacos-agent.XXXXXX)"
  CONFIG_DIR="$DATA_DIR"
fi

install -d -m 0755 "$INSTALL_DIR"
install -d -m 0700 "$DATA_DIR"
rm -rf "$INSTALL_DIR/pqc_dashboard"
install -m 0755 "$SOURCE_ROOT/agent.py" "$INSTALL_DIR/agent.py"
cp -R "$SOURCE_ROOT/pqc_dashboard" "$INSTALL_DIR/pqc_dashboard"
chmod -R a+rX "$INSTALL_DIR/pqc_dashboard"

CONFIG_PATH="$CONFIG_DIR/agent-config.json"
STATE_PATH="$DATA_DIR/agent-state.json"
SERVER="$SERVER" ENROLLMENT_TOKEN="$ENROLLMENT_TOKEN" NAME="$NAME" DATA_DIR="$DATA_DIR" STATE_PATH="$STATE_PATH" CONFIG_PATH="$CONFIG_PATH" "$PYTHON" - <<'PY'
import json, os
config = {
    "server": os.environ["SERVER"].rstrip("/"),
    "enrollmentToken": os.environ["ENROLLMENT_TOKEN"],
    "name": os.environ.get("NAME", ""),
    "dataDir": os.environ["DATA_DIR"],
    "stateFile": os.environ["STATE_PATH"],
    "pollingIntervalSeconds": 3,
}
with open(os.environ["CONFIG_PATH"], "w", encoding="utf-8") as handle:
    json.dump(config, handle, indent=2)
PY
chmod 0600 "$CONFIG_PATH"

if [[ "$MODE" == "permanent" ]]; then
  cat > /etc/systemd/system/stratacos-agent.service <<EOF
[Unit]
Description=Stratacos Security Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
WorkingDirectory=$INSTALL_DIR
ExecStart=$PYTHON -B $INSTALL_DIR/agent.py --config $CONFIG_PATH
Restart=always
RestartSec=5
UMask=0077
NoNewPrivileges=true
ReadWritePaths=$DATA_DIR

[Install]
WantedBy=multi-user.target
EOF
  systemctl daemon-reload
  systemctl enable stratacos-agent.service
  [[ "$START_NOW" -eq 1 ]] && systemctl restart stratacos-agent.service
  echo "Installed permanent Stratacos agent service."
  echo "State: $STATE_PATH"
else
  echo "Prepared ephemeral Stratacos agent. It has no startup service and uses temporary state."
  echo "Run once with: $PYTHON -B $INSTALL_DIR/agent.py --config $CONFIG_PATH"
  [[ "$START_NOW" -eq 1 ]] && exec "$PYTHON" -B "$INSTALL_DIR/agent.py" --config "$CONFIG_PATH"
fi