#!/usr/bin/env bash
# Fineliox Enterprise installer bootstrap (public).
# Downloads the customer package (install.sh + Compose + Cosign materials).
# Does not start the platform and does not skip license or Cosign checks.
#
# Prefer GitHub: Cloudflare on fineliox.com often returns HTTP 403 to AWS EC2 /
# datacenter IP ranges. Override with FINELIOX_DOWNLOAD_BASE / FINELIOX_PACKAGE_URL.
set -euo pipefail

BASE="${FINELIOX_DOWNLOAD_BASE:-https://raw.githubusercontent.com/fineliox/enterprise-installer/main}"
BASE="${BASE%/}"
PKG_URL="${FINELIOX_PACKAGE_URL:-https://github.com/fineliox/enterprise-installer/releases/latest/download/fineliox-enterprise-latest.tar.gz}"
SUMS_URL="${FINELIOX_CHECKSUMS_URL:-${BASE}/SHA256SUMS}"
DEST="${FINELIOX_INSTALL_DIR:-$PWD}"

umask 022
WORKDIR="$(mktemp -d)"
trap 'rm -rf "$WORKDIR"' EXIT

echo "Fineliox Enterprise installer"
echo "Downloading package from ${PKG_URL}"

if ! curl -fsSL "$PKG_URL" -o "$WORKDIR/fineliox-enterprise.tar.gz"; then
  echo "Primary package URL failed; trying website mirror..." >&2
  PKG_URL="https://fineliox.com/downloads/enterprise/fineliox-enterprise-latest.tar.gz"
  SUMS_URL="https://fineliox.com/downloads/enterprise/SHA256SUMS"
  curl -fsSL "$PKG_URL" -o "$WORKDIR/fineliox-enterprise.tar.gz"
fi

if curl -fsSL "$SUMS_URL" -o "$WORKDIR/SHA256SUMS"; then
  EXPECTED="$(awk '/fineliox-enterprise-latest\.tar\.gz$/ {print $1; exit}' "$WORKDIR/SHA256SUMS")"
  if [[ -n "$EXPECTED" ]]; then
    if command -v shasum >/dev/null 2>&1; then
      ACTUAL="$(shasum -a 256 "$WORKDIR/fineliox-enterprise.tar.gz" | awk '{print $1}')"
    else
      ACTUAL="$(sha256sum "$WORKDIR/fineliox-enterprise.tar.gz" | awk '{print $1}')"
    fi
    if [[ "$ACTUAL" != "$EXPECTED" ]]; then
      echo "Checksum mismatch. Refusing to extract." >&2
      echo "expected: $EXPECTED" >&2
      echo "actual:   $ACTUAL" >&2
      exit 1
    fi
    echo "Checksum OK"
  fi
else
  echo "Warning: could not download SHA256SUMS; continuing without checksum verify." >&2
fi

mkdir -p "$DEST"
tar -xzf "$WORKDIR/fineliox-enterprise.tar.gz" -C "$DEST"
DIR="$(find "$DEST" -maxdepth 1 -type d -name 'fineliox-enterprise-*' | sort | tail -n 1)"
if [[ -z "$DIR" || ! -x "$DIR/install.sh" ]]; then
  echo "Package extracted but install.sh was not found." >&2
  exit 1
fi

echo
echo "Package ready: $DIR"
echo
echo "Next (online Self-Hosted instance — pulls signed images; Docker/Compose/Cosign can be auto-installed if you accept):"
echo "  cd \"$DIR\""
echo "  ./install.sh --license /path/to/fineliox-license.lic"
echo "  # or non-interactive dependency install:"
echo "  ./install.sh --install-deps --license /path/to/fineliox-license.lic"
echo
echo "Air-gapped / offline hosts also need image tarballs in ./images/ — see https://fineliox.com/docs/enterprise/air-gapped"
echo "License files are issued from Fineliox Cloud → Account → Licenses (not included in this download)."
echo