#!/usr/bin/env bash
# Readable installer. Keep all operations inside main: truncated downloads
# cannot execute a partially received installation function.
set -euo pipefail
main() {
  local origin='https://get.battlefronteternal.com'
  local fingerprint='F210B0710D270963CB641C118043BCB331D34C9B'
  local arch machine work key distro glibc app target
  [ "$(uname -s)" = Linux ] || { echo 'This installer requires Linux.' >&2; return 1; }
  [ "$(id -u)" -ne 0 ] || { echo 'Run as your desktop user, without sudo.' >&2; return 1; }
  machine=$(uname -m)
  case "$machine" in x86_64) arch=x64;; aarch64|arm64) arch=arm64;; *) echo "Unsupported architecture: $machine" >&2; return 1;; esac
  glibc=$(getconf GNU_LIBC_VERSION 2>/dev/null | awk '{print $2}') || true
  [ -n "$glibc" ] && [ "$(printf '%s\n' 2.28 "$glibc" | sort -V | head -1)" = 2.28 ] || { echo 'glibc 2.28 or newer is required (Debian 10 / Ubuntu 20.04 or newer).' >&2; return 1; }
  distro=''
  if [ -r /etc/os-release ]; then . /etc/os-release; distro="${ID:-} ${ID_LIKE:-}"; fi
  if [[ "$distro" =~ (debian|ubuntu) ]]; then
    command -v sudo >/dev/null || { echo 'Install sudo before continuing.' >&2; return 1; }
    sudo apt-get update
    sudo apt-get install -y --no-install-recommends ca-certificates curl gnupg
  else
    for app in curl gpg sha256sum; do
      command -v "$app" >/dev/null || { echo "Install $app with your package manager, then try again." >&2; return 1; }
    done
  fi
  work=$(mktemp -d)
  trap 'rm -rf -- "$work"' EXIT
  export GNUPGHOME="$work/gnupg"
  mkdir -m 700 "$GNUPGHOME"
  curl --proto '=https' --tlsv1.2 -fsSL "$origin/keys/battlefront-eternal.asc" -o "$work/key.asc"
  key=$(gpg --batch --show-keys --with-colons "$work/key.asc" | awk -F: '$1=="fpr" {print $10; exit}')
  [ "$key" = "$fingerprint" ] || { echo 'Signing key fingerprint mismatch; stopping.' >&2; return 1; }
  gpg --batch --dearmor --output "$work/key.gpg" "$work/key.asc"
  if [[ "$distro" =~ (debian|ubuntu) ]]; then
    arch=$(dpkg --print-architecture)
    case "$arch" in amd64|arm64) ;; *) echo "Unsupported APT architecture: $arch" >&2; return 1;; esac
    sudo install -m 0644 "$work/key.gpg" /usr/share/keyrings/battlefront-eternal.gpg
    printf 'deb [arch=%s signed-by=/usr/share/keyrings/battlefront-eternal.gpg] %s/apt stable main\n' "$arch" "$origin" | sudo tee /etc/apt/sources.list.d/battlefront-eternal.list >/dev/null
    sudo apt-get update
    sudo apt-get install -y --no-install-recommends battlefront-eternal
    echo 'Installed. Open Battlefront Eternal from your app menu.'
  else
    app="Battlefront-Eternal-linux-$arch.AppImage"
    curl --proto '=https' --tlsv1.2 -fsSL "$origin/downloads/latest/manifest.json" -o "$work/manifest.json"
    # Pin every download to one immutable generation, even during publication.
    local release
    release=$(sed -n 's/.*"release_id": "\([a-zA-Z0-9._-]*\)".*/\1/p' "$work/manifest.json")
    [ -n "$release" ] || { echo 'No published Linux release is available.' >&2; return 1; }
    local source="$origin/downloads/$release"
    for target in SHA256SUMS SHA256SUMS.asc "$app"; do
      curl --proto '=https' --tlsv1.2 -fSL "$source/$target" -o "$work/$target"
    done
    gpgv --keyring "$work/key.gpg" "$work/SHA256SUMS.asc" "$work/SHA256SUMS"
    (cd "$work"; awk -v file="$app" '$2==file {print; found=1} END {if (!found) exit 1}' SHA256SUMS | sha256sum --check --strict -)
    target="${XDG_DATA_HOME:-$HOME/.local/share}/battlefront-eternal"
    mkdir -p "$target" "$HOME/.local/bin" "${XDG_DATA_HOME:-$HOME/.local/share}/applications"
    install -m 0755 "$work/$app" "$target/Battlefront-Eternal.AppImage.new"
    mv -f "$target/Battlefront-Eternal.AppImage.new" "$target/Battlefront-Eternal.AppImage"
    # Extract-and-run works on systems with FUSE 3 only, including Omarchy.
    printf '#!/usr/bin/env bash\nexport BFE_NO_DESKTOP_INTEGRATION=1\nexec %q --appimage-extract-and-run "$@"\n' "$target/Battlefront-Eternal.AppImage" > "$HOME/.local/bin/battlefront-eternal"
    chmod 0755 "$HOME/.local/bin/battlefront-eternal"
    local launcher="$HOME/.local/bin/battlefront-eternal"
    launcher=${launcher//\\/\\\\}; launcher=${launcher//\"/\\\"}; launcher=${launcher//\`/\\\`}; launcher=${launcher//\$/\\\$}; launcher=${launcher//%/%%}
    printf '[Desktop Entry]\nType=Application\nName=Battlefront Eternal\nExec="%s"\nIcon=applications-games\nCategories=Game;\nTerminal=false\n' "$launcher" > "${XDG_DATA_HOME:-$HOME/.local/share}/applications/battlefront-eternal.desktop"
    echo 'Installed. Open Battlefront Eternal from your app menu. Run this installer again to update.'
  fi
  rm -rf -- "$work"
  trap - EXIT
}
main "$@"