#!/usr/bin/env bash
set -euo pipefail

CA_URL="${CA_URL:-https://10.10.40.53}"
CA_FINGERPRINT="${CA_FINGERPRINT:-5fc8c379cab1119c1a9ac7038225f6bcf3a2ffb0e71b257af796b2bd6c71d594}"
STEP_VERSION="${STEP_VERSION:-0.28.7}"
FORCE="${FORCE:-0}"

usage() {
  cat <<EOF
Usage:
  $0 [--force]

Optional environment overrides:
  CA_URL
  CA_FINGERPRINT
  STEP_VERSION
  FORCE=1
EOF
}

log() {
  printf '\n[%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*"
}

fail() {
  echo "ERROR: $*" >&2
  exit 1
}

need_cmd() {
  command -v "$1" >/dev/null 2>&1
}

download_file() {
  local url="$1"
  local out="$2"

  if need_cmd curl; then
    curl -fsSL "$url" -o "$out"
  elif need_cmd wget; then
    wget -qO "$out" "$url"
  else
    fail "Neither curl nor wget is installed"
  fi
}

detect_os() {
  case "$(uname -s)" in
    Linux*) echo "linux" ;;
    Darwin*) echo "darwin" ;;
    MINGW*|MSYS*|CYGWIN*) echo "windows_bash" ;;
    *) echo "unknown" ;;
  esac
}

detect_arch() {
  case "$(uname -m)" in
    x86_64|amd64) echo "amd64" ;;
    aarch64|arm64) echo "arm64" ;;
    armv7l) echo "armv7" ;;
    *) uname -m ;;
  esac
}

install_step_linux() {
  local arch="$1"
  local tmpdir pkg_name url

  tmpdir="$(mktemp -d)"
  trap 'rm -rf "$tmpdir"' RETURN

  if need_cmd apk; then
    case "$arch" in
      amd64) pkg_name="step-cli_${STEP_VERSION}_amd64.apk" ;;
      arm64) pkg_name="step-cli_${STEP_VERSION}_arm64.apk" ;;
      *) fail "Unsupported Alpine architecture: $arch" ;;
    esac

    url="https://github.com/smallstep/cli/releases/download/v${STEP_VERSION}/${pkg_name}"
    download_file "$url" "$tmpdir/$pkg_name"
    sudo apk add --allow-untrusted "$tmpdir/$pkg_name"
    return
  fi

  if need_cmd dpkg; then
    case "$arch" in
      amd64) pkg_name="step-cli_${STEP_VERSION}_amd64.deb" ;;
      arm64) pkg_name="step-cli_${STEP_VERSION}_arm64.deb" ;;
      *) fail "Unsupported Debian/Ubuntu architecture: $arch" ;;
    esac

    url="https://github.com/smallstep/cli/releases/download/v${STEP_VERSION}/${pkg_name}"
    download_file "$url" "$tmpdir/$pkg_name"
    sudo dpkg -i "$tmpdir/$pkg_name" || {
      sudo apt-get update
      sudo apt-get install -f -y
    }
    return
  fi

  fail "Unsupported Linux distribution. Supported: Debian/Ubuntu and Alpine"
}

install_step_darwin() {
  if need_cmd brew; then
    brew install step
  else
    fail "Homebrew is required on macOS to install step automatically"
  fi
}

ensure_step() {
  if need_cmd step; then
    log "step CLI already installed"
    return
  fi

  local os arch
  os="$(detect_os)"
  arch="$(detect_arch)"

  log "Installing step CLI for $os/$arch"

  case "$os" in
    linux) install_step_linux "$arch" ;;
    darwin) install_step_darwin ;;
    windows_bash) fail "Use the PowerShell installer on native Windows" ;;
    *) fail "Unsupported OS: $os" ;;
  esac

  need_cmd step || fail "step CLI installation failed"
}

bootstrap_step() {
  if [ "$FORCE" = "1" ]; then
    rm -rf "$HOME/.step"
  fi

  log "Bootstrapping against $CA_URL"
  step ca bootstrap \
    --ca-url "$CA_URL" \
    --fingerprint "$CA_FINGERPRINT" \
    --install \
    --force
}

install_linux_trust() {
  local root_cert="$HOME/.step/certs/root_ca.crt"
  [ -f "$root_cert" ] || fail "Root certificate not found at $root_cert"

  if need_cmd update-ca-certificates; then
    sudo mkdir -p /usr/local/share/ca-certificates
    sudo cp "$root_cert" /usr/local/share/ca-certificates/insmw-root-ca.crt
    sudo update-ca-certificates
    return
  fi

  if need_cmd trust; then
    sudo trust anchor "$root_cert"
    return
  fi

  fail "Could not determine how to install the CA into this Linux trust store"
}

install_macos_trust() {
  local root_cert="$HOME/.step/certs/root_ca.crt"
  [ -f "$root_cert" ] || fail "Root certificate not found at $root_cert"

  sudo security add-trusted-cert \
    -d \
    -r trustRoot \
    -k /Library/Keychains/System.keychain \
    "$root_cert"
}

install_trust_store() {
  case "$(detect_os)" in
    linux) install_linux_trust ;;
    darwin) install_macos_trust ;;
    *) fail "Unsupported OS for trust-store installation" ;;
  esac
}

verify_install() {
  local root_cert="$HOME/.step/certs/root_ca.crt"
  log "Installed root CA:"
  step certificate inspect "$root_cert" --short || true
  echo
  echo "Done."
}

parse_args() {
  while [ $# -gt 0 ]; do
    case "$1" in
      --force)
        FORCE=1
        shift
        ;;
      -h|--help)
        usage
        exit 0
        ;;
      *)
        fail "Unknown argument: $1"
        ;;
    esac
  done
}

main() {
  parse_args "$@"
  ensure_step
  bootstrap_step
  install_trust_store
  verify_install
}

main "$@"