#!/usr/bin/env bash
# TokenTag installer for macOS: the tokentagd daemon (launchd service) and
# the TokenTag menubar app.
#
# Usage:
#   curl -fsSL https://install.tokentag.co | bash
#
# Environment:
#   TOKENTAG_BASE_URL  where the release tarballs live
#                      (default: the S3 bucket this script ships from)
#   TOKENTAG_VERSION   install a specific version, e.g. v0.2.0 (default: latest)
#   TOKENTAG_SERVER    control plane URL; if set, the device enrolls
#                      immediately via `tokentag up` after install
set -euo pipefail

# ── config ───────────────────────────────────────────────────────────────
# CloudFront in front of the tokentag-releases S3 bucket.
BASE_URL="${TOKENTAG_BASE_URL:-https://install.tokentag.co}"
BIN_DIR="/usr/local/bin"
APP_DIR="/Applications"
PLIST="/Library/LaunchDaemons/co.tokentag.tokentagd.plist"

info() { printf '\033[1;32m==>\033[0m %s\n' "$*"; }
warn() { printf '\033[1;33mwarning:\033[0m %s\n' "$*" >&2; }
fail() { printf '\033[1;31merror:\033[0m %s\n' "$*" >&2; exit 1; }

[ "$(uname -s)" = "Darwin" ] || fail "this installer currently supports macOS only"
command -v curl >/dev/null 2>&1 || fail "curl is required"

if [ -n "${TOKENTAG_VERSION:-}" ]; then
  TARBALL="tokentag-${TOKENTAG_VERSION}-macos-universal.tar.gz"
else
  TARBALL="tokentag-macos-universal.tar.gz"
fi

TMP="$(mktemp -d /tmp/tokentag-install.XXXXXX)"
trap 'rm -rf "$TMP"' EXIT

# ── download ─────────────────────────────────────────────────────────────
info "downloading ${BASE_URL}/${TARBALL}"
curl -fsSL "${BASE_URL}/${TARBALL}" -o "$TMP/tokentag.tar.gz" ||
  fail "download failed — check TOKENTAG_BASE_URL / TOKENTAG_VERSION"
tar -xzf "$TMP/tokentag.tar.gz" -C "$TMP"
[ -x "$TMP/tokentagd" ] || fail "tarball is missing tokentagd"

# ── binaries ─────────────────────────────────────────────────────────────
info "installing tokentagd and tokentag to ${BIN_DIR} (sudo required)"
sudo mkdir -p "$BIN_DIR"
sudo install -m 0755 "$TMP/tokentagd" "$TMP/tokentag" "$BIN_DIR/"

# ── menubar app ──────────────────────────────────────────────────────────
info "installing TokenTag.app to ${APP_DIR}"
pkill -x tokentag-desktop 2>/dev/null || true
sudo rm -rf "$APP_DIR/TokenTag.app"
sudo ditto "$TMP/TokenTag.app" "$APP_DIR/TokenTag.app"
sudo xattr -dr com.apple.quarantine "$APP_DIR/TokenTag.app" 2>/dev/null || true

# ── launchd service ──────────────────────────────────────────────────────
info "installing tokentagd launchd service"
if [ -f "$PLIST" ]; then
  # Upgrade path: unload the old daemon so install-service can reload cleanly.
  sudo launchctl unload -w "$PLIST" 2>/dev/null || true
fi
sudo "$BIN_DIR/tokentagd" install-service

# ── enroll (optional) ────────────────────────────────────────────────────
if [ -n "${TOKENTAG_SERVER:-}" ]; then
  info "enrolling with ${TOKENTAG_SERVER}"
  sudo "$BIN_DIR/tokentag" up --server "$TOKENTAG_SERVER" ||
    warn "enrollment did not complete; run it manually later"
fi

info "launching the TokenTag menubar app"
open -a "$APP_DIR/TokenTag.app" 2>/dev/null || true

echo
info "tokentag installed ($("$BIN_DIR/tokentagd" --version 2>/dev/null || true))"
if [ -z "${TOKENTAG_SERVER:-}" ]; then
  cat <<'EOF'

Next step — enroll this device with your control plane:

  sudo tokentag up --server https://your-control-plane:8443

The TokenTag menubar icon turns green once the device is enrolled and managed.
EOF
fi