#!/bin/bash
# RedFlag Agent Installer - Linux
# Generated for agent: {{.AgentID}}
# Platform: {{.Platform}}
# Architecture: {{.Architecture}}
# Version: {{.Version}}

set -e

AGENT_ID="{{.AgentID}}"
BINARY_URL="{{.BinaryURL}}"
CONFIG_URL="{{.ConfigURL}}"
INSTALL_DIR="/usr/local/bin"
CONFIG_DIR="/etc/redflag"
OLD_CONFIG_DIR="/etc/aggregator"
SERVICE_NAME="redflag-agent"
VERSION="{{.Version}}"
LOG_DIR="/var/log/redflag"
BACKUP_DIR="${CONFIG_DIR}/backups/backup.$(date +%s)"

echo "=== RedFlag Agent v${VERSION} Installation ==="
echo "Agent ID: ${AGENT_ID}"
echo "Platform: {{.Platform}}"
echo "Installing to: ${INSTALL_DIR}/${SERVICE_NAME}"
echo

# Step 1: Detect existing installation
echo "Detecting existing RedFlag installations..."
MIGRATION_NEEDED=false

if [ -f "${CONFIG_DIR}/config.json" ]; then
    echo "✓ Existing installation detected at ${CONFIG_DIR}"
    MIGRATION_NEEDED=true
elif [ -f "${OLD_CONFIG_DIR}/config.json" ]; then
    echo "⚠ Old installation detected at ${OLD_CONFIG_DIR} - MIGRATION REQUIRED"
    MIGRATION_NEEDED=true
else
    echo "✓ Fresh installation"
fi

# Step 2: Create backup if migration needed
if [ "${MIGRATION_NEEDED}" = true ]; then
    echo
    echo "=== Migration Required ==="
    echo "Agent will migrate on first start. Backing up configuration..."
    sudo mkdir -p "${BACKUP_DIR}"
    
    if [ -f "${OLD_CONFIG_DIR}/config.json" ]; then
        echo "Backing up old configuration..."
        sudo cp -r "${OLD_CONFIG_DIR}"/* "${BACKUP_DIR}/" 2>/dev/null || true
    fi
    
    if [ -f "${CONFIG_DIR}/config.json" ]; then
        echo "Backing up current configuration..."
        sudo cp "${CONFIG_DIR}/config.json" "${BACKUP_DIR}/config.json.backup" 2>/dev/null || true
    fi
    
    echo "Migration will run automatically when agent starts."
    echo "View migration logs with: sudo journalctl -u ${SERVICE_NAME} -f"
    echo
fi

# Step 3: Stop existing service
if systemctl is-active --quiet ${SERVICE_NAME} 2>/dev/null; then
    echo "Stopping existing RedFlag agent service..."
    sudo systemctl stop ${SERVICE_NAME}
fi

# Step 4: Create directories
echo "Creating directories..."
sudo mkdir -p "${CONFIG_DIR}"
sudo mkdir -p "${CONFIG_DIR}/backups"
sudo mkdir -p "/var/lib/redflag"
sudo mkdir -p "/var/log/redflag"

# Step 5: Download agent binary
echo "Downloading agent binary..."
sudo curl -sSL -o "${INSTALL_DIR}/${SERVICE_NAME}" "${BINARY_URL}"
sudo chmod +x "${INSTALL_DIR}/${SERVICE_NAME}"

# Step 6: Handle configuration
# IMPORTANT: The agent handles its own migration on first start.
# We either preserve existing config OR create a minimal template.
if [ -f "${CONFIG_DIR}/config.json" ]; then
    echo "[CONFIG] Upgrade detected - preserving existing configuration"
    echo "[CONFIG] Agent will handle migration automatically on first start"
    echo "[CONFIG] Backup created at: ${BACKUP_DIR}"
else
    echo "[CONFIG] Fresh install - generating minimal configuration with registration token"
    # Create minimal config template - agent will populate missing fields on first start
    sudo cat > "${CONFIG_DIR}/config.json" <<EOF
{
    "version": 5,
    "agent_version": "${VERSION}",
    "agent_id": "",
    "token": "",
    "refresh_token": "",
    "registration_token": "{{.RegistrationToken}}",
    "machine_id": "",
    "check_in_interval": 300,
    "server_url": "{{.ServerURL}}",
    "network": {
        "timeout": 30000000000,
        "retry_count": 3,
        "retry_delay": 5000000000,
        "max_idle_conn": 10
    },
    "proxy": {
        "enabled": false
    },
    "tls": {
        "enabled": false,
        "insecure_skip_verify": false
    },
    "logging": {
        "level": "info",
        "max_size": 100,
        "max_backups": 3,
        "max_age": 28
    },
    "subsystems": {
        "system": {"enabled": true, "timeout": 10000000000, "circuit_breaker": {"enabled": true, "failure_threshold": 3, "failure_window": 600000000000, "open_duration": 1800000000000, "half_open_attempts": 2}},
        "filesystem": {"enabled": true, "timeout": 10000000000, "circuit_breaker": {"enabled": true, "failure_threshold": 3, "failure_window": 600000000000, "open_duration": 1800000000000, "half_open_attempts": 2}},
        "network": {"enabled": true, "timeout": 30000000000, "circuit_breaker": {"enabled": true, "failure_threshold": 3, "failure_window": 600000000000, "open_duration": 1800000000000, "half_open_attempts": 2}},
        "processes": {"enabled": true, "timeout": 30000000000, "circuit_breaker": {"enabled": true, "failure_threshold": 3, "failure_window": 600000000000, "open_duration": 1800000000000, "half_open_attempts": 2}},
        "updates": {"enabled": true, "timeout": 30000000000, "circuit_breaker": {"enabled": false, "failure_threshold": 0, "failure_window": 0, "open_duration": 0, "half_open_attempts": 0}},
        "storage": {"enabled": true, "timeout": 10000000000, "circuit_breaker": {"enabled": true, "failure_threshold": 3, "failure_window": 600000000000, "open_duration": 1800000000000, "half_open_attempts": 2}}
    },
    "security": {
        "ed25519_verification": true,
        "nonce_validation": true,
        "machine_id_binding": true
    }
}
EOF
fi

# Step 7: Set permissions on config file
sudo chmod 600 "${CONFIG_DIR}/config.json"

# Step 8: Create systemd service
echo "Creating systemd service..."
cat <<EOF | sudo tee /etc/systemd/system/${SERVICE_NAME}.service
[Unit]
Description=RedFlag Security Agent
After=network.target

[Service]
Type=simple
User=root
ExecStart=${INSTALL_DIR}/${SERVICE_NAME}
Restart=always
RestartSec=30

[Install]
WantedBy=multi-user.target
EOF

# Step 9: Enable and start service
echo "Enabling and starting service..."
sudo systemctl daemon-reload
sudo systemctl enable ${SERVICE_NAME}
sudo systemctl start ${SERVICE_NAME}

echo
echo "✓ Installation complete!"
echo "Agent is running. Check status with: sudo systemctl status ${SERVICE_NAME}"
echo "View logs with: sudo journalctl -u ${SERVICE_NAME} -f"