#!/usr/bin/env bash
# ═══════════════════════════════════════════════════════════════
# NISGuard Agent Installer
# ═══════════════════════════════════════════════════════════════
# Usage:
#   curl -sL https://install.nis-guard.eu | sh -s -- <SITE_TOKEN>
#   curl -sL https://install.nis-guard.eu | sh -s -- <SITE_TOKEN> --docker
# ═══════════════════════════════════════════════════════════════
set -euo pipefail

C_RED="\033[1;31m"; C_GRN="\033[1;32m"; C_YLW="\033[1;33m"; C_CYN="\033[1;36m"; C_RST="\033[0m"
log()  { printf "${C_CYN}[NISGuard]${C_RST} %s\n" "$*"; }
ok()   { printf "${C_GRN}✓${C_RST} %s\n" "$*"; }
warn() { printf "${C_YLW}!${C_RST} %s\n" "$*"; }
err()  { printf "${C_RED}✗${C_RST} %s\n" "$*" >&2; }

# --- Uninstall-Modus (curl -sL https://install.nis-guard.eu | sh -s -- --uninstall) ---
case " $* " in *" --uninstall "*|*" uninstall "*)
  echo "[NISGuard] Deinstalliere Agent ..."
  if command -v systemctl >/dev/null 2>&1; then sudo systemctl disable --now nisguard-agent 2>/dev/null || true; sudo rm -f /etc/systemd/system/nisguard-agent.service; sudo systemctl daemon-reload 2>/dev/null || true; fi
  if [ "$(uname -s)" = "Darwin" ]; then sudo launchctl unload /Library/LaunchDaemons/eu.nis-guard.log-agent.plist 2>/dev/null || true; sudo rm -f /Library/LaunchDaemons/eu.nis-guard.log-agent.plist; fi
  docker rm -f nisguard-agent >/dev/null 2>&1 || true
  sudo rm -rf /opt/nisguard-agent /etc/nisguard
  echo "NISGuard Agent entfernt."
  exit 0
;; esac

TOKEN="${1:-}"
MODE="native"
shift || true
for arg in "$@"; do
  case "$arg" in
    --docker) MODE="docker" ;;
    --systemd) MODE="systemd" ;;
  esac
done

if [ -z "$TOKEN" ] || [[ ! "$TOKEN" =~ ^[A-Za-z0-9_-]+$ ]]; then
  err "Site-Token fehlt oder ungültig."
  echo
  echo "Verwendung:"
  echo "  curl -sL https://install.nis-guard.eu | sh -s -- NG-XXXX-XXXX-XXXX"
  echo
  echo "Token findest du im Dashboard → Geräte → Edge Agent → Provisioning."
  exit 1
fi

log "Erkenne System ..."
OS="$(uname -s)"
ARCH="$(uname -m)"
case "$OS" in
  Linux*)  PLATFORM=linux ;;
  Darwin*) PLATFORM=macos ;;
  *)       err "Plattform nicht unterstützt: $OS"; exit 1 ;;
esac
ok "$PLATFORM/$ARCH"

API_BASE="${NISGUARD_API:-https://api.nis-guard.eu}"

# ── Docker-Modus ─────────────────────────────────────────────
if [ "$MODE" = "docker" ]; then
  if ! command -v docker >/dev/null 2>&1; then
    err "Docker nicht installiert. Installiere mit: curl -fsSL https://get.docker.com | sh"
    exit 1
  fi
  log "Lade Image ..."
  if ! docker pull nisguard/agent:latest >/dev/null 2>&1 \
     && ! docker pull ghcr.io/rduetsch/nisguard-agent:latest >/dev/null 2>&1; then
    warn "Public Registry nicht erreichbar — lade tar-Fallback ..."
    TMP=$(mktemp -d) && trap "rm -rf $TMP" EXIT
    curl -fsSL "https://install.nis-guard.eu/agent.tar" -o "$TMP/agent.tar" || {
      err "Image-Download fehlgeschlagen."; exit 1
    }
    docker load -i "$TMP/agent.tar" >/dev/null
  fi
  log "Starte Container ..."
  docker rm -f nisguard-agent >/dev/null 2>&1 || true
  docker run -d \
    --name nisguard-agent \
    --restart unless-stopped \
    --network host \
    -e NISGUARD_TOKEN="$TOKEN" \
    -e NISGUARD_API="$API_BASE" \
    -v /var/log:/host/var/log:ro \
    -v /etc/nisguard:/etc/nisguard \
    nisguard/agent:latest
  ok "Container nisguard-agent läuft."
  echo
  echo "Status:    docker ps --filter name=nisguard-agent"
  echo "Logs:      docker logs -f nisguard-agent"
  echo "Stop:      docker rm -f nisguard-agent"
  exit 0
fi

# ── Native Python-Modus ──────────────────────────────────────
log "Prüfe Python ..."
if ! command -v python3 >/dev/null 2>&1; then
  warn "python3 fehlt — versuche zu installieren ..."
  if [ "$PLATFORM" = "linux" ]; then
    if command -v apt-get >/dev/null; then sudo apt-get update && sudo apt-get install -y python3 python3-pip
    elif command -v dnf >/dev/null; then sudo dnf install -y python3 python3-pip
    elif command -v apk >/dev/null; then sudo apk add --no-cache python3 py3-pip
    else err "Kein Paket-Manager erkannt. Bitte python3 manuell installieren."; exit 1; fi
  else
    err "Bitte python3 installieren (z.B. via Homebrew: brew install python)."; exit 1
  fi
fi
ok "$(python3 --version)"

INSTALL_DIR="/opt/nisguard-agent"
sudo mkdir -p "$INSTALL_DIR" && sudo chown "$(id -u):$(id -g)" "$INSTALL_DIR"
log "Lade Agent-Skript ..."
curl -fsSL "${API_BASE/api./install.}/nisguard-log-agent.py" -o "$INSTALL_DIR/nisguard-log-agent.py" \
  || curl -fsSL "https://install.nis-guard.eu/nisguard-log-agent.py" -o "$INSTALL_DIR/nisguard-log-agent.py"
chmod +x "$INSTALL_DIR/nisguard-log-agent.py"
ok "Agent in $INSTALL_DIR"

log "Installiere Python-Abhängigkeiten ..."
python3 -m pip install --quiet --user requests pyyaml

# Agent registrieren: Site-Token -> langlebiges Agent-Token + device_id
log "Registriere Agent am Dashboard ..."
ENROLL=$(curl -fsS -X POST "$API_BASE/api/v1/agent/enroll" \
  -H "Content-Type: application/json" \
  -d "{\"site_token\":\"$TOKEN\",\"hostname\":\"$(hostname)\",\"platform\":\"$PLATFORM\"}") || {
    err "Registrierung fehlgeschlagen — Site-Token pruefen (Dashboard -> Sites -> Edge Agent)."; exit 1; }
API_KEY=$(printf '%s' "$ENROLL" | python3 -c "import sys,json;print(json.load(sys.stdin).get('api_key',''))")
DEVICE_ID=$(printf '%s' "$ENROLL" | python3 -c "import sys,json;print(json.load(sys.stdin).get('device_id',''))")
if [ -z "$API_KEY" ] || [ -z "$DEVICE_ID" ]; then
  err "Registrierung ohne Token/Device-ID — Abbruch."; exit 1
fi
ok "Agent registriert (device $DEVICE_ID)"

# Config schreiben (Dict-Form je Quelltyp — genau was der Agent liest; plattform-abhaengig)
mkdir -p "$HOME/.config/nisguard"
CFG="$HOME/.config/nisguard/agent.yml"
if [ "$PLATFORM" = "macos" ]; then
  SOURCES_YAML="  macos_unified_log:
    enabled: true
    predicates:
      - \"eventMessage CONTAINS 'error'\"
      - \"eventMessage CONTAINS 'fail'\"
      - \"eventMessage CONTAINS 'denied'\"
  file_log:
    enabled: true
    paths:
      - /var/log/system.log
      - /var/log/install.log"
else
  SOURCES_YAML="  journald:
    enabled: true
    priorities: [emerg, alert, crit, err, warning]
  file_log:
    enabled: true
    paths:
      - /var/log/syslog
      - /var/log/auth.log"
fi
cat > "$CFG" << EOF
api_url: $API_BASE
api_key: $API_KEY
device_id: $DEVICE_ID
interval: 30
batch_size: 50
sources:
$SOURCES_YAML
EOF
ok "Konfiguration in $CFG"

# Systemd-Service (optional)
if [ "$PLATFORM" = "linux" ] && [ "$MODE" != "manual" ] && command -v systemctl >/dev/null; then
  log "Installiere systemd-Service ..."
  sudo tee /etc/systemd/system/nisguard-agent.service >/dev/null << EOF
[Unit]
Description=NISGuard Log Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=$(id -un)
ExecStart=/usr/bin/python3 $INSTALL_DIR/nisguard-log-agent.py --config $CFG
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF
  sudo systemctl daemon-reload
  sudo systemctl enable --now nisguard-agent
  ok "Service nisguard-agent läuft (systemctl status nisguard-agent)"
fi

# launchd-Dienst (macOS) — LaunchDaemon, laeuft bei Boot, KeepAlive
if [ "$PLATFORM" = "macos" ] && [ "$MODE" != "manual" ]; then
  log "Installiere launchd-Dienst (LaunchDaemon) ..."
  PY="$(command -v python3)"
  PLIST=/Library/LaunchDaemons/eu.nis-guard.log-agent.plist
  sudo tee "$PLIST" >/dev/null << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key><string>eu.nis-guard.log-agent</string>
    <key>ProgramArguments</key>
    <array>
        <string>$PY</string>
        <string>$INSTALL_DIR/nisguard-log-agent.py</string>
        <string>--config</string>
        <string>$CFG</string>
    </array>
    <key>RunAtLoad</key><true/>
    <key>KeepAlive</key><true/>
    <key>StandardOutPath</key><string>/var/log/nisguard-agent.log</string>
    <key>StandardErrorPath</key><string>/var/log/nisguard-agent.log</string>
</dict>
</plist>
EOF
  sudo launchctl unload "$PLIST" 2>/dev/null || true
  sudo launchctl load "$PLIST"
  ok "LaunchDaemon geladen (Status: sudo launchctl list | grep nisguard)"
fi

echo
ok "Installation abgeschlossen."
echo
echo "Verbindung testen:    curl -sf $API_BASE/health && echo OK"
if [ "$PLATFORM" = "macos" ]; then
  echo "Logs anzeigen:        tail -f /var/log/nisguard-agent.log"
  echo "Dienst-Status:        sudo launchctl list | grep nisguard"
else
  echo "Logs anzeigen:        sudo journalctl -u nisguard-agent -f"
fi
echo "Status im Dashboard:  https://app.nis-guard.eu/devices"