#!/usr/bin/env bash
#
# install.sh — 本机一键准备 cloudflared + 写入 ~/.ssh/config
# ---------------------------------------------------------------------------
# 作用：在用户自己的电脑（Mac / Linux / Windows WSL）上：
#   1) 自动安装 cloudflared（已装则跳过）
#   2) 把一条 "Host sandbox" 配置写进 ~/.ssh/config
#
# 用法：
#   curl -fsSL https://montano-skills-hub.pages.dev/skills/cloudflared-ssh/scripts/install.sh | bash
#   curl -fsSL https://montano-skills-hub.pages.dev/skills/cloudflared-ssh/scripts/install.sh | bash -s -- <裸域名>
#
#   不传域名 -> 写入占位域名，需手动替换
#   传域名   -> 自动填入 ~/.ssh/config 的 HostName（裸域名，不带 https://）
#
#   或本地：  bash install.sh [裸域名]
# ---------------------------------------------------------------------------
set -euo pipefail

DOMAIN_ARG="${1:-}"

log(){ echo "[install] $*"; }

# ---------- 1. 安装 cloudflared ----------
if command -v cloudflared >/dev/null 2>&1; then
  log "cloudflared 已安装: $(cloudflared --version 2>/dev/null | head -1)"
else
  log "正在安装 cloudflared ..."
  if [ "$(uname)" = Darwin ]; then
    if command -v brew >/dev/null 2>&1; then
      brew install cloudflared
    else
      echo "[!] macOS 未检测到 Homebrew，请先安装 brew：https://brew.sh"; exit 1
    fi
  elif [ "$(uname -o 2>/dev/null)" = Msys ] || [ "$(uname -o 2>/dev/null)" = Cygwin ]; then
    if command -v winget >/dev/null 2>&1; then
      winget install -e --id Cloudflare.cloudflared
    else
      echo "[!] Windows 未检测到 winget，请手动安装 cloudflared"; exit 1
    fi
  else
    ARCH=$( [ "$(uname -m)" = aarch64 ] || [ "$(uname -m)" = arm64 ] && echo arm64 || echo amd64 )
    sudo curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-$ARCH" -o /usr/local/bin/cloudflared
    sudo chmod +x /usr/local/bin/cloudflared
  fi
  log "cloudflared 安装完成"
fi

# ---------- 2. 写入 ~/.ssh/config ----------
SSH_CFG="$HOME/.ssh/config"
mkdir -p "$HOME/.ssh"
chmod 700 "$HOME/.ssh" 2>/dev/null || true

# 确定域名：传入的参数 > 已有的 HostName > 占位
BACKEND_HOST="$DOMAIN_ARG"
if [ -z "$BACKEND_HOST" ]; then
  BACKEND_HOST="<远端 setup.sh 输出的裸域名，如 xxxx.trycloudflare.com>"
fi

# 去掉用户误传的 https:// 前缀
BACKEND_HOST="${BACKEND_HOST#https://}"
BACKEND_HOST="${BACKEND_HOST#http://}"

if grep -q "^Host sandbox$" "$SSH_CFG" 2>/dev/null; then
  if [ -n "$DOMAIN_ARG" ]; then
    # 已存在 Host sandbox，且有传入域名 -> 更新 HostName
    log "~/.ssh/config 中已存在 Host sandbox，更新 HostName 为 $BACKEND_HOST ..."
    sed -i.bak "/^Host sandbox$/,/^# ---/ s|HostName .*|HostName $BACKEND_HOST|" "$SSH_CFG" 2>/dev/null || \
      sed -i.bak "/^Host sandbox$/,/^# ---/ s|HostName.*|HostName $BACKEND_HOST|" "$SSH_CFG"
    log "HostName 已更新（备份保存在 ~/.ssh/config.bak）"
  else
    log "~/.ssh/config 中已存在 Host sandbox，跳过写入"
    log "提示: 远端跑完 setup.sh 后，手动替换 HostName 为输出的裸域名"
  fi
else
  cat >> "$SSH_CFG" <<EOF

# --- 由 cloudflared-ssh skill 自动添加 ---
Host sandbox
    HostName $BACKEND_HOST
    User root
    ProxyCommand cloudflared access ssh --hostname %h
    StrictHostKeyChecking no
# -----------------------------------------
EOF
  chmod 600 "$SSH_CFG" 2>/dev/null || true
  if [ -n "$DOMAIN_ARG" ]; then
    log "已向 ~/.ssh/config 追加 Host sandbox（域名: $BACKEND_HOST）"
  else
    log "已向 ~/.ssh/config 追加 Host sandbox（占位域名，请替换为远端真实裸域名）"
  fi
fi

echo
echo "========================================================"
echo "  本机准备完成"
echo "========================================================"
if [ -n "$DOMAIN_ARG" ]; then
  echo "  域名已自动填入: $BACKEND_HOST"
  echo "  直接执行:  ssh sandbox"
else
  echo "  后续步骤："
  echo "  1) 在远端 Linux 机器跑:  sudo bash setup.sh"
  echo "  2) 把输出的裸域名替换进 ~/.ssh/config 的 HostName"
  echo "     或重新跑:  curl -fsSL .../install.sh | bash -s -- <裸域名>"
  echo "  3) 本机执行:  ssh sandbox"
fi
echo ""
echo "  ⚠ 提醒: HostName 必须用裸域名（不带 https://）"
echo "========================================================"