#!/usr/bin/env bash
set -euo pipefail

HUB_URL="${1:-http://hub.example.com:8443}"
ENROLL_SECRET="${2:-}"

INSTALL_DIR="/opt/logar-client"
CONFIG_DIR="/etc/logar"

# 1. Mutual Exclusion Check: Deny installation if LOGAR Server is present
if [ -f "/opt/logar-server/Server" ] || [ -f "/etc/systemd/system/logar-server.service" ]; then
    echo "[-] Error: LOGAR Server is already installed on this machine." >&2
    echo "[-] LOGAR Client cannot be installed on a host where LOGAR Server is present (LOGAR Server includes built-in log collection)." >&2
    echo "[-] Please uninstall LOGAR Server first before installing LOGAR Client." >&2
    exit 1
fi

# 2. Existing LOGAR Client Detection for In-Place Update Mode
IS_UPDATE=0
if [ -f "${INSTALL_DIR}/Linux_Client" ] || [ -f "/etc/systemd/system/logar-client.service" ]; then
    IS_UPDATE=1
    echo "[*] Existing LOGAR Client installation detected. Performing in-place upgrade..."
fi

if [ "${IS_UPDATE}" -eq 1 ] && command -v systemctl >/dev/null 2>&1; then
    echo "[*] Stopping LOGAR Client service for upgrade..."
    systemctl stop logar-client.service || true
fi

echo "[+] Installing LOGAR Client..."
mkdir -p "${INSTALL_DIR}" "${CONFIG_DIR}/certs"
chmod 700 "${CONFIG_DIR}/certs"

BIN_INSTALLED=0
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"

if [ -f "${SCRIPT_DIR}/Linux_Client.bin" ]; then
    cp "${SCRIPT_DIR}/Linux_Client.bin" "${INSTALL_DIR}/Linux_Client"
    BIN_INSTALLED=1
elif [ -f "${SCRIPT_DIR}/Linux_Client" ]; then
    cp "${SCRIPT_DIR}/Linux_Client" "${INSTALL_DIR}/Linux_Client"
    BIN_INSTALLED=1
elif [ -f "dist/Linux_Client.bin" ]; then
    cp dist/Linux_Client.bin "${INSTALL_DIR}/Linux_Client"
    BIN_INSTALLED=1
elif [ -f "dist/Linux_Client" ]; then
    cp dist/Linux_Client "${INSTALL_DIR}/Linux_Client"
    BIN_INSTALLED=1
elif [ -f "Linux_Client.bin" ]; then
    cp Linux_Client.bin "${INSTALL_DIR}/Linux_Client"
    BIN_INSTALLED=1
elif [ -f "Linux_Client" ]; then
    cp Linux_Client "${INSTALL_DIR}/Linux_Client"
    BIN_INSTALLED=1
fi

# If binary is not available locally, fetch standalone binary from LOGAR Hub
if [ "${BIN_INSTALLED}" -eq 0 ] && [ ! -f "${INSTALL_DIR}/Linux_Client" ]; then
    echo "[*] Client binary not found locally. Fetching standalone Linux client binary from LOGAR Hub (${HUB_URL}/api/client/update/download?os=linux)..."
    if command -v curl >/dev/null 2>&1; then
        curl -fsSL "${HUB_URL}/api/client/update/download?os=linux" -o "${INSTALL_DIR}/Linux_Client" || true
    elif command -v wget >/dev/null 2>&1; then
        wget -qO "${INSTALL_DIR}/Linux_Client" "${HUB_URL}/api/client/update/download?os=linux" || true
    fi
fi

if [ -f "${INSTALL_DIR}/Linux_Client" ] && [ -s "${INSTALL_DIR}/Linux_Client" ]; then
    chmod +x "${INSTALL_DIR}/Linux_Client"
    echo "[+] Standalone Linux Client executable installed at ${INSTALL_DIR}/Linux_Client"
else
    echo "[-] Error: Failed to acquire LOGAR Linux client executable binary." >&2
    echo "[-] Please provide Linux_Client.bin in the installer directory or verify HUB_URL connectivity." >&2
    exit 1
fi

# Bootstrap certificate if missing and enrollment secret is provided
if [ ! -f "${CONFIG_DIR}/certs/client.crt" ] && [ -n "${ENROLL_SECRET}" ]; then
    echo "[+] Enrolling client with LOGAR Hub..."
    MACHINE_ID=$(cat /etc/machine-id 2>/dev/null || hostname)
    RESPONSE=$(curl -s -X POST "${HUB_URL}/api/client/enroll" \
        -H "Content-Type: application/json" \
        -d "{\"client_id\": \"${MACHINE_ID}\", \"hostname\": \"$(hostname)\", \"os\": \"linux\", \"enrollment_secret\": \"${ENROLL_SECRET}\"}")
    
    echo "${RESPONSE}" | grep -q "client_cert" || {
        echo "[!] Enrollment failed: ${RESPONSE}"
        exit 1
    }

    if command -v jq >/dev/null 2>&1; then
        echo "${RESPONSE}" | jq -r .ca_cert > "${CONFIG_DIR}/certs/ca.crt"
        echo "${RESPONSE}" | jq -r .client_cert > "${CONFIG_DIR}/certs/client.crt"
        echo "${RESPONSE}" | jq -r .client_key > "${CONFIG_DIR}/certs/client.key"
    else
        python3 -c "import sys, json; data=json.loads(sys.stdin.read()); open('${CONFIG_DIR}/certs/ca.crt','w').write(data['ca_cert']); open('${CONFIG_DIR}/certs/client.crt','w').write(data['client_cert']); open('${CONFIG_DIR}/certs/client.key','w').write(data['client_key'])" <<< "${RESPONSE}"
    fi
    chmod 600 "${CONFIG_DIR}/certs/client.key"
    echo "[+] Certificates written to ${CONFIG_DIR}/certs"
fi

cat <<EOF > /etc/systemd/system/logar-client.service
[Unit]
Description=LOGAR Edge Log Aggregator Client
After=network.target

[Service]
Type=simple
ExecStart=${INSTALL_DIR}/Linux_Client --config ${CONFIG_DIR}/config.json
Restart=always
RestartSec=5s
User=root

[Install]
WantedBy=multi-user.target
EOF

if command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload
    systemctl enable --now logar-client.service || true
    echo "[+] LOGAR Client service configured and activated."
else
    echo "[+] Systemd service installed at /etc/systemd/system/logar-client.service"
fi