#!/usr/bin/env bash
#
# install.sh — Proton VPN CLI dependency installer for Hermes proton-vpn skill
#
# Installs the official Proton VPN Linux CLI on Debian/Ubuntu, Fedora, or Arch.
# Run as root or with sudo.
#
# Usage:
#   sudo ./install.sh          # auto-detect distro and install
#   sudo ./install.sh --check  # only check if already installed
#

set -euo pipefail

# ── colors ─────────────────────────────────────────────────────────────

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

info()  { echo -e "${BLUE}[INFO]${NC}  $*"; }
ok()    { echo -e "${GREEN}[OK]${NC}    $*"; }
warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
err()   { echo -e "${RED}[ERROR]${NC} $*"; }

# ── check if installed ─────────────────────────────────────────────────

check_installed() {
    if command -v protonvpn-cli &>/dev/null; then
        local version
        version=$(protonvpn-cli --version 2>/dev/null || echo "unknown")
        ok "protonvpn-cli is already installed (version: $version)"
        return 0
    fi
    return 1
}

# ── detect distro ──────────────────────────────────────────────────────

detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        echo "$ID"
    elif command -v lsb_release &>/dev/null; then
        lsb_release -is | tr '[:upper:]' '[:lower:]'
    else
        echo "unknown"
    fi
}

# ── Debian/Ubuntu install ──────────────────────────────────────────────

install_debian() {
    info "Adding Proton VPN repository..."

    # Install prerequisites
    apt-get update -qq
    apt-get install -y -qq curl gnupg ca-certificates

    # Add Proton VPN repo key and source
    curl -fsSL 'https://repo.protonvpn.com/debian/dists/stable/main/signed.key' | \
        gpg --dearmor -o /usr/share/keyrings/protonvpn.gpg

    cat > /etc/apt/sources.list.d/protonvpn.list <<EOF
deb [signed-by=/usr/share/keyrings/protonvpn.gpg] https://repo.protonvpn.com/debian stable main
EOF

    apt-get update -qq
    apt-get install -y -qq protonvpn-cli

    ok "protonvpn-cli installed via apt"
}

# ── Fedora install ─────────────────────────────────────────────────────

install_fedora() {
    info "Installing protonvpn-cli via dnf..."
    dnf install -y protonvpn-cli
    ok "protonvpn-cli installed via dnf"
}

# ── Arch install ───────────────────────────────────────────────────────

install_arch() {
    info "Installing protonvpn-cli from AUR (via yay)..."
    if ! command -v yay &>/dev/null; then
        err "yay (AUR helper) not found. Install yay first or use:"
        err "  git clone https://aur.archlinux.org/protonvpn-cli.git"
        err "  cd protonvpn-cli && makepkg -si"
        exit 1
    fi
    yay -S --noconfirm protonvpn-cli
    ok "protonvpn-cli installed via AUR"
}

# ── post-install setup ────────────────────────────────────────────────

post_install() {
    info "Performing post-install setup..."

    # Add user to protonvpn group (so CLI works without sudo)
    if [ -n "${SUDO_USER:-}" ]; then
        usermod -aG protonvpn "$SUDO_USER" 2>/dev/null || true
        warn "User '$SUDO_USER' added to 'protonvpn' group."
        warn "Log out and back in for group membership to take effect."
    fi

    # Check systemd-resolved
    if systemctl is-active --quiet systemd-resolved 2>/dev/null; then
        ok "systemd-resolved is running"
    else
        warn "systemd-resolved is not running. DNS leak protection may not work."
        warn "  Enable: sudo systemctl enable --now systemd-resolved"
    fi

    # Check NetworkManager
    if systemctl is-active --quiet NetworkManager 2>/dev/null; then
        ok "NetworkManager is running"
    else
        warn "NetworkManager is not running. protonvpn-cli requires it."
    fi

    # Check gnome-keyring
    if command -v gnome-keyring-daemon &>/dev/null; then
        ok "gnome-keyring found"
    else
        warn "gnome-keyring not found. Install it for credential storage."
        warn "  sudo apt install gnome-keyring   # Debian/Ubuntu"
        warn "  sudo dnf install gnome-keyring   # Fedora"
    fi

    echo ""
    info "Setup complete! Run 'protonvpn-cli login' to authenticate."
    info "Then try: protonvpn-cli status"
}

# ── main ───────────────────────────────────────────────────────────────

main() {
    echo ""
    echo "  ┌─────────────────────────────────────┐"
    echo "  │  Proton VPN CLI — Hermes Skill Setup │"
    echo "  └─────────────────────────────────────┘"
    echo ""

    if [ "$1" = "--check" ]; then
        check_installed
        exit $?
    fi

    if check_installed; then
        post_install
        exit 0
    fi

    if [ "$(id -u)" -ne 0 ]; then
        err "This script must be run as root (sudo ./install.sh)"
        exit 1
    fi

    distro=$(detect_distro)
    info "Detected distribution: $distro"

    case "$distro" in
        debian|ubuntu|linuxmint|pop|elementary|kali|zorin|mx)
            install_debian
            ;;
        fedora|rhel|centos)
            install_fedora
            ;;
        arch|manjaro|endeavouros|artix)
            install_arch
            ;;
        *)
            err "Unsupported distro: $distro"
            err "Manual installation: see https://protonvpn.com/support/linux-cli"
            exit 1
            ;;
    esac

    post_install
}

main "${1:-install}"