#!/bin/sh
# veil installer — downloads the AppImage, verifies it against the published
# checksum, marks it executable, and puts a launcher in your applications menu
# so "double-click veil" is actually true afterwards.
#
# Nothing here touches your system except: (1) the one package install below,
# which is only run after you say yes, and (2) files under your own $HOME
# (~/.local/bin, ~/.local/share/applications, ~/.local/share/icons). No system
# directories, no root shell, no background process left running.
#
#   curl -fsSL https://veilapp.pages.dev/install.sh | sh
#
set -eu

VERSION="0.2.1"
REPO="BiksY01/veil"
ARTIFACT="veil-${VERSION}-x86_64.AppImage"
RELEASE_URL="https://github.com/${REPO}/releases/download/v${VERSION}"
INSTALL_DIR="$HOME/.local/bin"
DESKTOP_DIR="$HOME/.local/share/applications"
ICON_DIR="$HOME/.local/share/icons/hicolor/scalable/apps"
APPIMAGE_PATH="$INSTALL_DIR/veil.AppImage"

say()  { printf '%s\n' "$*"; }
die()  { printf 'error: %s\n' "$*" >&2; exit 1; }
have() { command -v "$1" >/dev/null 2>&1; }

have curl || die "curl is required and wasn't found on PATH"

# ---- 1. detect package manager (used only for the FUSE check below) --------
PM=""
if have apt-get;      then PM=apt
elif have dnf;         then PM=dnf
elif have pacman;      then PM=pacman
elif have zypper;      then PM=zypper
elif have apk;         then PM=apk
elif have xbps-install; then PM=xbps
elif have emerge;      then PM=emerge
fi

fuse_present() {
  { ldconfig -p 2>/dev/null || /sbin/ldconfig -p 2>/dev/null; } | grep -q 'libfuse\.so\.2' && return 0
  for p in /usr/lib/x86_64-linux-gnu/libfuse.so.2 /usr/lib64/libfuse.so.2 \
           /usr/lib/libfuse.so.2 /lib/x86_64-linux-gnu/libfuse.so.2; do
    [ -e "$p" ] && return 0
  done
  return 1
}

# ---- 2. FUSE: AppImages need libfuse2 to mount themselves ------------------
if fuse_present; then
  say "FUSE already present."
else
  say "veil's AppImage needs libfuse2 to mount itself — not found on this system."
  case "$PM" in
    apt)    FUSE_CMD="sudo apt-get install -y libfuse2t64 || sudo apt-get install -y libfuse2" ;;
    dnf)    FUSE_CMD="sudo dnf install -y fuse-libs" ;;
    pacman) FUSE_CMD="sudo pacman -S --needed fuse2" ;;
    zypper) FUSE_CMD="sudo zypper install -y libfuse2" ;;
    apk)    FUSE_CMD="sudo apk add fuse" ;;
    xbps)   FUSE_CMD="sudo xbps-install -y fuse" ;;
    emerge) FUSE_CMD="sudo emerge sys-fs/fuse:0" ;;
    *)      FUSE_CMD="" ;;
  esac
  if [ -n "$FUSE_CMD" ]; then
    # Read from /dev/tty rather than stdin: when this script runs as
    # `curl ... | sh`, stdin is the script itself, not the user's keyboard.
    if [ -r /dev/tty ]; then
      printf 'Install it now with: %s\nProceed? [y/N] ' "$FUSE_CMD"
      if read -r ans < /dev/tty; then
        case "$ans" in
          y|Y|yes|YES) sh -c "$FUSE_CMD" || say "package install failed — install it yourself, then re-run this script." ;;
          *) say "skipping — the AppImage may refuse to start until libfuse2 is installed." ;;
        esac
      else
        say "run this yourself, then re-run this script:"
        say "  $FUSE_CMD"
      fi
    else
      say "run this yourself, then re-run this script:"
      say "  $FUSE_CMD"
    fi
  else
    say "couldn't identify your package manager. Install whatever package on your"
    say "distro provides libfuse.so.2 (usually called fuse2 or libfuse2), then re-run this."
  fi
fi

# ---- 3. download + verify ---------------------------------------------------
WORKDIR="$(mktemp -d)"
trap 'rm -rf "$WORKDIR"' EXIT

say "downloading $ARTIFACT..."
curl -fsSL -o "$WORKDIR/$ARTIFACT" "$RELEASE_URL/$ARTIFACT"
curl -fsSL -o "$WORKDIR/SHA256SUMS" "$RELEASE_URL/SHA256SUMS"

EXPECTED="$(grep " $ARTIFACT\$" "$WORKDIR/SHA256SUMS" | awk '{print $1}')"
[ -n "$EXPECTED" ] || die "couldn't find $ARTIFACT in the published SHA256SUMS — refusing to install an unverified file"

if have sha256sum; then
  ACTUAL="$(sha256sum "$WORKDIR/$ARTIFACT" | awk '{print $1}')"
elif have shasum; then
  ACTUAL="$(shasum -a 256 "$WORKDIR/$ARTIFACT" | awk '{print $1}')"
else
  die "no sha256sum/shasum on PATH — can't verify the download, refusing to install"
fi

[ "$EXPECTED" = "$ACTUAL" ] || die "checksum mismatch — downloaded file does not match the published release. Do not run it."
say "checksum verified."

# ---- 4. install --------------------------------------------------------------
mkdir -p "$INSTALL_DIR" "$DESKTOP_DIR" "$ICON_DIR"
mv "$WORKDIR/$ARTIFACT" "$APPIMAGE_PATH"
chmod +x "$APPIMAGE_PATH"

ICON_PATH="$ICON_DIR/veil.svg"
curl -fsSL -o "$ICON_PATH" "https://veilapp.pages.dev/assets/logo.svg" 2>/dev/null || ICON_PATH=""

cat > "$DESKTOP_DIR/veil.desktop" <<DESKTOP
[Desktop Entry]
Type=Application
Name=veil
Comment=See what your machine is telling everyone
Exec=$APPIMAGE_PATH
Icon=${ICON_PATH:-utilities-system-monitor}
Categories=Utility;Security;
Terminal=false
StartupWMClass=veil
DESKTOP

# Some desktops (GNOME/Nautilus in particular) refuse to run a launcher until
# it's marked trusted; harmless no-op everywhere else.
chmod +x "$DESKTOP_DIR/veil.desktop"
have gio && gio set "$DESKTOP_DIR/veil.desktop" metadata::trusted true 2>/dev/null || true

say ""
say "done. veil is in your applications menu — search \"veil\"."
say "installed at: $APPIMAGE_PATH"
say "prefer a terminal: $APPIMAGE_PATH"