#!/bin/bash
set -e

GREEN='\033[0;32m'; BLUE='\033[0;34m'; RED='\033[0;31m'; NC='\033[0m'
TOKEN=$1

if [ -z "$TOKEN" ]; then
    echo -e "${BLUE}Usage: sudo bash install.sh <enrollment_token>${NC}"
    exit 1
fi
if [ "$EUID" -ne 0 ]; then echo -e "${RED}❌ Run as root: sudo bash install.sh YOUR_TOKEN${NC}"; exit 1; fi

echo -e "${BLUE}══════════════════════════════════════════════${NC}"
echo -e "${BLUE}  SAILLENT Enforcement Agent Installer${NC}"
echo -e "${BLUE}══════════════════════════════════════════════${NC}"

echo -e "${BLUE}→ Enrolling node...${NC}"
ENROLL_RESP=$(curl -s -X POST https://license.saillent.com/v1/enroll -H "Content-Type: application/json" -d "{\"token\":\"$TOKEN\"}")
INSTALL_ID=$(echo "$ENROLL_RESP" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("license",{}).get("installation_id",""))' 2>/dev/null || echo "")
ORG_NAME=$(echo "$ENROLL_RESP" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("license",{}).get("organization",""))' 2>/dev/null || echo "")
if [ -z "$INSTALL_ID" ]; then
    echo -e "${RED}✗ Enrollment failed. Token invalid, used, or expired.${NC}"
    exit 1
fi
echo -e "${GREEN}✓ Authenticated for: $ORG_NAME${NC}"

PLATFORM="linux-amd64"
# SECURITY: Embedded Ed25519 public key (trust anchor)
SAILLENT_PUBKEY='-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEA2GnGkE4cLd1RiP1NWheHAw8J7uVpgjdZ+fM8NLVWCCA=
-----END PUBLIC KEY-----'

echo -e "${BLUE}→ Fetching binary checksum and signature...${NC}"
CHECKSUM_RESP=$(curl -fsSL --retry 3 --retry-delay 2 "https://license.saillent.com/v1/download-checksum?platform=$PLATFORM" || echo "")
if [ -z "$CHECKSUM_RESP" ]; then
    echo -e "${RED}✗ Could not reach SAILLENT Authority${NC}"
    exit 1
fi

# Parse checksum without python3 dependency
EXPECTED_SHA=$(echo "$CHECKSUM_RESP" | grep -o '"sha256":"[^"]*"' | cut -d'"' -f4)
SIGNATURE_B64=$(echo "$CHECKSUM_RESP" | grep -o '"signature":"[^"]*"' | cut -d'"' -f4)

if [ -z "$EXPECTED_SHA" ]; then
    echo -e "${RED}✗ Missing checksum in response${NC}"
    exit 1
fi
echo -e "${GREEN}✓ Expected SHA-256: ${EXPECTED_SHA:0:16}...${NC}"
[ -n "$SIGNATURE_B64" ] && echo -e "${GREEN}✓ Ed25519 signature present${NC}"

echo -e "${BLUE}→ Downloading SAILLENT Agent (with retries)...${NC}"
mkdir -p /opt/saillent
if ! curl -fsSL --retry 3 --retry-delay 2 --retry-connrefused \
    -o /opt/saillent/saillent-agent \
    "https://license.saillent.com/v1/download?platform=$PLATFORM"; then
    echo -e "${RED}✗ Download failed after 3 retries${NC}"
    rm -f /opt/saillent/saillent-agent
    exit 1
fi
chmod +x /opt/saillent/saillent-agent

# VERIFICATION #1: Checksum (integrity)
ACTUAL_SHA=$(sha256sum /opt/saillent/saillent-agent | cut -d' ' -f1)
if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then
    echo -e "${RED}╔══════════════════════════════════════════╗${NC}"
    echo -e "${RED}║  ⚠️  CHECKSUM MISMATCH — ABORTING!       ║${NC}"
    echo -e "${RED}╚══════════════════════════════════════════╝${NC}"
    rm -f /opt/saillent/saillent-agent
    exit 1
fi
echo -e "${GREEN}✓ Checksum verified — binary is intact${NC}"

# VERIFICATION #2: Ed25519 signature (authenticity - CRITICAL)
if [ -n "$SIGNATURE_B64" ] && command -v openssl >/dev/null 2>&1; then
    TMPKEY=$(mktemp)
    TMPSIG=$(mktemp)
    echo "$SAILLENT_PUBKEY" > "$TMPKEY"
    echo "$SIGNATURE_B64" | base64 -d > "$TMPSIG" 2>/dev/null

    if openssl pkeyutl -verify -pubin -inkey "$TMPKEY" -rawin -in /opt/saillent/saillent-agent -sigfile "$TMPSIG" >/dev/null 2>&1; then
        echo -e "${GREEN}✓ Ed25519 signature VERIFIED — binary is authentic${NC}"
    else
        echo -e "${RED}╔══════════════════════════════════════════════════╗${NC}"
        echo -e "${RED}║  🚨 CRITICAL: SIGNATURE VERIFICATION FAILED!    ║${NC}"
        echo -e "${RED}║  Binary may be TAMPERED or from UNTRUSTED source║${NC}"
        echo -e "${RED}╚══════════════════════════════════════════════════╝${NC}"
        rm -f /opt/saillent/saillent-agent "$TMPKEY" "$TMPSIG"
        exit 1
    fi
    rm -f "$TMPKEY" "$TMPSIG"
elif [ -n "$SIGNATURE_B64" ]; then
    echo -e "${YELLOW}⚠ openssl not available - skipping signature verification${NC}"
fi

echo -e "${BLUE}→ Generating Secure Admin Key...${NC}"
ADMIN_KEY=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c 48)
cat > /opt/saillent/.env << ENV
SAILLENT_ADMIN_API_KEY=$ADMIN_KEY
SAILLENT_INSTALLATION_ID=$INSTALL_ID
SAILLENT_ORG_NAME=$ORG_NAME
ENV
chmod 600 /opt/saillent/.env

echo -e "${BLUE}→ Configuring systemd service...${NC}"
cat > /etc/systemd/system/saillent-proxy.service << SVC
[Unit]
Description=SAILLENT AI Action Firewall
After=network.target

[Service]
Type=simple
EnvironmentFile=/opt/saillent/.env
ExecStart=/opt/saillent/saillent-agent
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
SVC

systemctl daemon-reload
systemctl enable saillent-proxy >/dev/null 2>&1
systemctl restart saillent-proxy
sleep 2

if systemctl is-active --quiet saillent-proxy; then
    echo ""
    echo -e "${GREEN}✅ SAILLENT INSTALLED SUCCESSFULLY!${NC}"
    echo "🔒 ADMIN KEY (SAVE THIS): $ADMIN_KEY"
    echo "🌍 Dashboard: http://localhost:3000"
    echo "📊 Status: systemctl status saillent-proxy"
else
    echo -e "${RED}❌ Service failed to start: journalctl -u saillent-proxy -n 50${NC}"
    exit 1
fi