#!/usr/bin/env bash
# paua installer
# curl -sSf https://paua.sh | bash

set -euo pipefail

PAUA_BASE="${PAUA_BASE:-https://paua.sh}"
PAUA_PGP_KEY_URL="${PAUA_PGP_KEY_URL:-${PAUA_BASE}/pgp-key.asc}"
PAUA_BIN_DIR="${HOME}/.local/bin"
PAUA_CONFIG_DIR="${HOME}/.config/paua"
PAUA_BIN="${PAUA_BIN_DIR}/paua"

for cmd in curl bash; do
  command -v "$cmd" &>/dev/null || { printf 'error: %s is required\n' "$cmd" >&2; exit 1; }
done

printf 'Installing paua...\n'
mkdir -p "${PAUA_BIN_DIR}" "${PAUA_CONFIG_DIR}"

signatures_required() {
  [[ "${PAUA_REQUIRE_SIGNATURES:-false}" == "true" ]]
}

verify_cli() {
  local cli_path="${1}"
  local sig_file
  sig_file=$(mktemp)

  if ! curl -sSf --max-time 30 "${PAUA_BASE}/cli.sig" -o "${sig_file}" 2>/dev/null \
    || [[ ! -s "${sig_file}" ]]; then
    rm -f "${sig_file}"
    if signatures_required; then
      printf '\nerror: no signature found for paua CLI\n' >&2
      return 1
    fi
    printf '\nwarning: no signature found for paua CLI; continuing\n' >&2
    return 0
  fi

  if ! command -v gpg &>/dev/null; then
    rm -f "${sig_file}"
    if signatures_required; then
      printf '\nerror: gpg is required for signature verification but was not found\n' >&2
      return 1
    fi
    printf '\nwarning: gpg not found; continuing without CLI signature verification\n' >&2
    return 0
  fi

  local key_file gnupg_home
  key_file=$(mktemp)
  gnupg_home=$(mktemp -d)
  chmod 700 "${gnupg_home}"
  local ok=0

  curl -sSf --max-time 30 "${PAUA_PGP_KEY_URL}" -o "${key_file}" 2>/dev/null || ok=$?
  if [[ "${ok}" -eq 0 ]]; then
    GNUPGHOME="${gnupg_home}" gpg --batch --quiet --import "${key_file}" &>/dev/null || ok=$?
  fi
  if [[ "${ok}" -eq 0 ]]; then
    GNUPGHOME="${gnupg_home}" gpg --batch --quiet --verify "${sig_file}" "${cli_path}" \
      &>/dev/null || ok=$?
  fi

  rm -f "${key_file}" "${sig_file}"
  rm -rf "${gnupg_home}"

  if [[ "${ok}" -ne 0 ]]; then
    printf '\nerror: signature verification failed for paua CLI\n' >&2
    return 1
  fi
}

printf 'Downloading paua CLI... '
tmp_cli=$(mktemp)
trap 'rm -f "${tmp_cli}"' EXIT
curl -sSf --max-time 30 "${PAUA_BASE}/cli" -o "${tmp_cli}" \
  || { printf '\nerror: failed to download paua from %s/cli\n' "${PAUA_BASE}" >&2; exit 1; }
verify_cli "${tmp_cli}"
mv "${tmp_cli}" "${PAUA_BIN}"
chmod +x "${PAUA_BIN}"
printf 'done\n'

# Read from /dev/tty so the prompt works even when stdin is the curl pipe.
# Print the prompt explicitly (read -p writes to stderr which 2>/dev/null would suppress).
AUTO_UPDATE="false"
if [[ -t 1 ]]; then
  printf '\nEnable automatic self-updates? [y/N] '
  read -r reply </dev/tty || reply=""
  [[ "${reply}" =~ ^[Yy]$ ]] && AUTO_UPDATE="true"
fi

if [[ ! -f "${PAUA_CONFIG_DIR}/config.toml" ]]; then
  printf 'auto_update = %s\n' "${AUTO_UPDATE}" > "${PAUA_CONFIG_DIR}/config.toml"
fi

printf '\npaua installed to %s\n' "${PAUA_BIN}"

if ! printf ':%s:' "${PATH}" | grep -q ":${PAUA_BIN_DIR}:"; then
  printf '\nAdd to your shell profile (~/.bashrc, ~/.zshrc, etc.):\n'
  printf '\n  export PATH="${HOME}/.local/bin:${PATH}"\n\n'
fi

printf 'Run "paua help" to get started.\n'