#!/usr/bin/env bash
# install-macos.sh — instalador do Vulcan-Music Server (Core) para macOS.
# Instala o servidor, sobe a infra via Docker Desktop, e registra como launchd agent.
#
# Distribuicao DIRETA. Ate termos o certificado Apple Developer (US$99/ano) e notarizacao,
# o macOS mostrara "nao foi possivel verificar o desenvolvedor". Ver docs/SECURITY-WARNINGS.md
# para as instrucoes que o usuario deve seguir (Ajustes > Privacidade e Seguranca > Abrir assim mesmo).

set -euo pipefail

VM_VERSION="${VM_VERSION:-latest}"
VM_HOME="${VM_HOME:-$HOME/Library/Application Support/VulcanMusic}"
VM_PORT="${VM_PORT:-4533}"
VM_RELEASE_BASE="${VM_RELEASE_BASE:-https://pub-8c12e933ae274e2d8176d39ee91fa8c3.r2.dev/${VM_VERSION}}"

YELLOW='\033[1;33m'; NC='\033[0m'
cat <<BANNER

${YELLOW}╔════════════════════════════════════════════════════════════════════════╗
║                    AVISO DE SEGURANCA — LEIA                            ║
╠════════════════════════════════════════════════════════════════════════╣
║ Este instalador baixa o Vulcan-Music Server do R2 publico.              ║
║                                                                          ║
║ • O binario NAO esta notarizado pela Apple. Gatekeeper vai alertar.    ║
║ • Voce precisara liberar manualmente:                                   ║
║     Ajustes do Sistema > Privacidade e Seguranca > 'Abrir assim mesmo' ║
║ • Integridade verificada via SHA256.                                    ║
║ • CTRL+C para abortar.                                                  ║
╚════════════════════════════════════════════════════════════════════════╝${NC}

BANNER
sleep 2

GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'; BLUE='\033[0;34m'; NC='\033[0m'
info()  { echo -e "${GREEN}[vulcan-music]${NC} $*"; }
warn()  { echo -e "${YELLOW}[vulcan-music]${NC} $*"; }
err()   { echo -e "${RED}[vulcan-music]${NC} $*" >&2; }
step()  { echo -e "\n${BLUE}==>${NC} $*"; }

step "Verificando o sistema"
if [ "$(uname -s)" != "Darwin" ]; then
  err "Este instalador e para macOS."
  exit 1
fi

ARCH="$(uname -m)"
case "$ARCH" in
  arm64)  VM_ARCH="arm64" ;;   # Apple Silicon
  x86_64) VM_ARCH="amd64" ;;   # Intel
  *) err "Arquitetura nao suportada: $ARCH"; exit 1 ;;
esac
info "Arquitetura: $VM_ARCH"

step "Verificando Docker Desktop"
if ! command -v docker >/dev/null 2>&1; then
  err "Docker Desktop nao encontrado."
  err "Instale em https://www.docker.com/products/docker-desktop/ e rode de novo."
  exit 1
fi
info "Docker OK."

step "Criando diretorios"
mkdir -p "$VM_HOME"/{bin,config,data,music}
info "Musica vai em: $VM_HOME/music"

step "Baixando o Vulcan-Music Server ($VM_ARCH)"
BINARY_URL="${VM_RELEASE_BASE}/vulcan-music-server-darwin-${VM_ARCH}"
if curl -fsSL -o "$VM_HOME/bin/vulcan-music-server" "$BINARY_URL"; then
  # Verificacao de integridade
  if curl -fsSL -o /tmp/vm.sha256 "${BINARY_URL}.sha256" 2>/dev/null; then
    EXPECTED="$(awk '{print $1}' /tmp/vm.sha256)"
    ACTUAL="$(shasum -a 256 "$VM_HOME/bin/vulcan-music-server" | awk '{print $1}')"
    [ "$EXPECTED" = "$ACTUAL" ] && info "Checksum OK." || { err "Checksum nao confere."; exit 1; }
  fi
  chmod +x "$VM_HOME/bin/vulcan-music-server"
  # Remove quarentena para evitar bloqueio do Gatekeeper (ate termos notarizacao)
  xattr -d com.apple.quarantine "$VM_HOME/bin/vulcan-music-server" 2>/dev/null || true
  info "Binario instalado."
else
  warn "Release nao disponivel; em dev compile: cd server && go build -o '$VM_HOME/bin/vulcan-music-server' ./cmd/server"
fi

step "Subindo a infra (Postgres, Redis, Meilisearch)"
cat > "$VM_HOME/docker-compose.yml" <<'COMPOSE'
services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: vulcan
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: vulcan_music
    volumes: [ "./data/pg:/var/lib/postgresql/data" ]
    ports: [ "127.0.0.1:5432:5432" ]
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes: [ "./data/redis:/data" ]
    ports: [ "127.0.0.1:6379:6379" ]
  meilisearch:
    image: getmeili/meilisearch:v1.9
    restart: unless-stopped
    environment:
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY}
      MEILI_ENV: production
    volumes: [ "./data/meili:/meili_data" ]
    ports: [ "127.0.0.1:7700:7700" ]
COMPOSE

if [ ! -f "$VM_HOME/config/secrets.env" ]; then
  {
    echo "POSTGRES_PASSWORD=$(openssl rand -hex 24)"
    echo "MEILI_MASTER_KEY=$(openssl rand -hex 24)"
    echo "JWT_SECRET=$(openssl rand -hex 32)"
  } > "$VM_HOME/config/secrets.env"
  chmod 600 "$VM_HOME/config/secrets.env"
fi

( cd "$VM_HOME" && set -a && . config/secrets.env && set +a && docker compose up -d )
info "Infra no ar (so localhost)."

step "Registrando launchd agent (inicia no login)"
PLIST="$HOME/Library/LaunchAgents/com.vulcanmusic.server.plist"
mkdir -p "$HOME/Library/LaunchAgents"
cat > "$PLIST" <<PLISTEOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.vulcanmusic.server</string>
  <key>ProgramArguments</key>
  <array>
    <string>$VM_HOME/bin/vulcan-music-server</string>
    <string>--config</string>
    <string>$VM_HOME/config/config.toml</string>
  </array>
  <key>RunAtLoad</key><true/>
  <key>KeepAlive</key><true/>
</dict>
</plist>
PLISTEOF
launchctl unload "$PLIST" 2>/dev/null || true
launchctl load "$PLIST" 2>/dev/null || warn "launchd nao carregou (binario pode nao existir em dev)."

step "Instalacao concluida"
info "Acesse o controle web em: http://localhost:$VM_PORT"
info "Coloque musicas em: $VM_HOME/music"
warn "Se o macOS bloquear o app: Ajustes do Sistema > Privacidade e Seguranca > 'Abrir assim mesmo'."
warn "Isso e normal ate publicarmos com certificado Apple. Ver docs/SECURITY-WARNINGS.md."