#!/usr/bin/env bash
set -euo pipefail

HUB_URL="${1:-http://hub.example.com:8443}"
ENROLL_SECRET="${2:-}"

INSTALL_DIR="/opt/logar-client"
CONFIG_DIR="/etc/logar"

# 1. Mutual Exclusion Check: Deny installation if LOGAR Server is present
if [ -f "/opt/logar-server/Server" ] || [ -f "/etc/systemd/system/logar-server.service" ]; then
    echo "[-] Error: LOGAR Server is already installed on this machine." >&2
    echo "[-] LOGAR Client cannot be installed on a host where LOGAR Server is present (LOGAR Server includes built-in log collection)." >&2
    echo "[-] Please uninstall LOGAR Server first before installing LOGAR Client." >&2
    exit 1
fi

# 2. Existing LOGAR Client Detection for In-Place Update Mode
IS_UPDATE=0
if [ -f "${INSTALL_DIR}/Linux_Client" ] || [ -f "/etc/systemd/system/logar-client.service" ]; then
    IS_UPDATE=1
    echo "[*] Existing LOGAR Client installation detected. Performing in-place upgrade..."
fi

if [ "${IS_UPDATE}" -eq 1 ] && command -v systemctl >/dev/null 2>&1; then
    echo "[*] Stopping LOGAR Client service for upgrade..."
    systemctl stop logar-client.service || true
fi

echo "[+] Installing LOGAR Client..."
mkdir -p "${INSTALL_DIR}" "${CONFIG_DIR}/certs"
chmod 700 "${CONFIG_DIR}/certs"

if [ -f "dist/Linux_Client.bin" ]; then
    cp dist/Linux_Client.bin "${INSTALL_DIR}/Linux_Client"
elif [ -f "dist/Linux_Client" ]; then
    cp dist/Linux_Client "${INSTALL_DIR}/Linux_Client"
else
    echo "[!] Warning: dist/Linux_Client binary not found in current directory. Continuing with existing binary if present."
fi

if [ -f "${INSTALL_DIR}/Linux_Client" ]; then
    chmod +x "${INSTALL_DIR}/Linux_Client"
fi

# Bootstrap certificate if missing and enrollment secret is provided
if [ ! -f "${CONFIG_DIR}/certs/client.crt" ] && [ -n "${ENROLL_SECRET}" ]; then
    echo "[+] Enrolling client with LOGAR Hub..."
    MACHINE_ID=$(cat /etc/machine-id 2>/dev/null || hostname)
    RESPONSE=$(curl -s -X POST "${HUB_URL}/api/client/enroll" \
        -H "Content-Type: application/json" \
        -d "{\"client_id\": \"${MACHINE_ID}\", \"hostname\": \"$(hostname)\", \"os\": \"linux\", \"enrollment_secret\": \"${ENROLL_SECRET}\"}")
    
    echo "${RESPONSE}" | grep -q "client_cert" || {
        echo "[!] Enrollment failed: ${RESPONSE}"
        exit 1
    }

    if command -v jq >/dev/null 2>&1; then
        echo "${RESPONSE}" | jq -r .ca_cert > "${CONFIG_DIR}/certs/ca.crt"
        echo "${RESPONSE}" | jq -r .client_cert > "${CONFIG_DIR}/certs/client.crt"
        echo "${RESPONSE}" | jq -r .client_key > "${CONFIG_DIR}/certs/client.key"
    else
        python3 -c "import sys, json; data=json.loads(sys.stdin.read()); open('${CONFIG_DIR}/certs/ca.crt','w').write(data['ca_cert']); open('${CONFIG_DIR}/certs/client.crt','w').write(data['client_cert']); open('${CONFIG_DIR}/certs/client.key','w').write(data['client_key'])" <<< "${RESPONSE}"
    fi
    chmod 600 "${CONFIG_DIR}/certs/client.key"
    echo "[+] Certificates written to ${CONFIG_DIR}/certs"
fi

cat <<EOF > /etc/systemd/system/logar-client.service
[Unit]
Description=LOGAR Edge Log Aggregator Client
After=network.target

[Service]
Type=simple
ExecStart=${INSTALL_DIR}/Linux_Client --config ${CONFIG_DIR}/config.json
Restart=always
RestartSec=5s
User=root

[Install]
WantedBy=multi-user.target
EOF

if command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload
    systemctl enable --now logar-client.service || true
    echo "[+] LOGAR Client service configured and activated."
else
    echo "[+] Systemd service installed at /etc/systemd/system/logar-client.service"
fi