#!/bin/sh
# sc — the someones.computer deploy agent.
#
#   curl -fsSL https://staging.someones.computer/install.sh | sh
#
# Installs a single static binary. Nothing else is written, no daemon is
# started, and uninstalling is `rm` on the path it prints.
set -eu

CHANNEL='dev'
VERSION='0.1.58-snapshot-e586c51'
ENDPOINT="${SC_INSTALL_ENDPOINT:-https://staging.someones.computer}"

# Where the binary lands. Resolved below: /usr/local/bin when that is writable,
# ~/.local/bin otherwise. $SC_INSTALL_DIR overrides both.
PREFIX="${SC_INSTALL_DIR:-}"

say() { printf '%s\n' "$*"; }
die() { printf 'sc: %s\n' "$*" >&2; exit 1; }

# ---------------------------------------------------------------- platform --
os=$(uname -s | tr '[:upper:]' '[:lower:]')
arch=$(uname -m)

case "$os" in
    linux|darwin) ;;
    msys*|mingw*|cygwin*) die "this script is for Linux and macOS — take the Windows zip from $ENDPOINT/install" ;;
    *) die "unsupported operating system: $os" ;;
esac

case "$arch" in
    x86_64|amd64) arch=amd64 ;;
    aarch64|arm64) arch=arm64 ;;
    *) die "unsupported architecture: $arch" ;;
esac

# The archive and its checksum, one branch per published build. Written out
# rather than derived so a platform this release does not cover is a clear
# message instead of a 404 halfway through a download.
case "$os/$arch" in
    'darwin/amd64') archive='sc_0.1.58-snapshot-e586c51_darwin_amd64.tar.gz'; checksum='21246ec1aac607905b1d25b20a32c8cb3e5b36df19d7103fed2350710c8f2ed1' ;;
    'darwin/arm64') archive='sc_0.1.58-snapshot-e586c51_darwin_arm64.tar.gz'; checksum='82ad6576a4bd8d30459b31c938241a01be3966d0724840f756881ff6f5496702' ;;
    'linux/amd64') archive='sc_0.1.58-snapshot-e586c51_linux_amd64.tar.gz'; checksum='f2648939478b04d9f524b01d98be06c9c2949f8eb19d334c4f75d6ecff6302e0' ;;
    'linux/arm64') archive='sc_0.1.58-snapshot-e586c51_linux_arm64.tar.gz'; checksum='887f66d0d9457db822fe6fbc37cc43d0cb7af18b9cbef9377a07390879e93023' ;;
    *) die "no sc 0.1.58-snapshot-e586c51 build for $os/$arch — see $ENDPOINT/install" ;;
esac

# ------------------------------------------------------------------- fetch --
if command -v curl >/dev/null 2>&1; then
    fetch() { curl -fsSL "$1" -o "$2"; }
elif command -v wget >/dev/null 2>&1; then
    fetch() { wget -qO "$2" "$1"; }
else
    die 'neither curl nor wget is installed'
fi

tmp=$(mktemp -d "${TMPDIR:-/tmp}/sc-install.XXXXXX")
# Covers the error paths too, which is most of them: every `die` past this point
# exits through the trap.
trap 'rm -rf "$tmp"' EXIT INT TERM

say "Downloading sc $VERSION ($CHANNEL) for $os/$arch…"
fetch "$ENDPOINT/install/$CHANNEL/$os/$arch" "$tmp/$archive" \
    || die "download failed: $ENDPOINT/install/$CHANNEL/$os/$arch"

# ------------------------------------------------------------------ verify --
# sha256sum on Linux, shasum -a 256 on macOS. A machine with neither is not
# waved through: shipping an unverified binary is the one thing this will not do.
if command -v sha256sum >/dev/null 2>&1; then
    actual=$(sha256sum "$tmp/$archive" | cut -d' ' -f1)
elif command -v shasum >/dev/null 2>&1; then
    actual=$(shasum -a 256 "$tmp/$archive" | cut -d' ' -f1)
else
    die 'no sha256sum or shasum available to verify the download'
fi

[ "$actual" = "$checksum" ] || die "checksum mismatch for $archive
  expected $checksum
  got      $actual"

tar -xzf "$tmp/$archive" -C "$tmp" || die "could not unpack $archive"
[ -f "$tmp/sc" ] || die "$archive did not contain an sc binary"

# ----------------------------------------------------------------- install --
if [ -z "$PREFIX" ]; then
    if [ -w /usr/local/bin ]; then
        PREFIX=/usr/local/bin
    else
        # No silent `sudo`: a machine where /usr/local/bin needs root gets a
        # per-user install, which needs no privilege and is trivial to undo.
        PREFIX="$HOME/.local/bin"
    fi
fi

mkdir -p "$PREFIX" || die "cannot create $PREFIX"
install -m 0755 "$tmp/sc" "$PREFIX/sc" || die "cannot write $PREFIX/sc"

say "Installed sc $VERSION to $PREFIX/sc"

# `command -v` rather than a $PATH substring test: what matters is whether the
# shell would find *this* sc, and a stale copy earlier in PATH is worth saying.
found=$(command -v sc 2>/dev/null || true)
if [ "$found" != "$PREFIX/sc" ]; then
    say ''
    if [ -n "$found" ]; then
        say "Note: \`sc\` still resolves to $found, not the copy just installed."
    else
        say "Note: $PREFIX is not on your PATH. Add it:"
        say ''
        say "    export PATH=\"$PREFIX:\$PATH\""
    fi
fi

say ''
say 'Next: sign in, then deploy from your project directory.'
say ''
say '    sc login --staging'
say '    sc deploy'