#!/usr/bin/env bash

set -euo pipefail

# bootstrap.sh - authenticate with GitHub, download bootstrap from tk755/machines, and run it.
#
#   curl -fsSL https://bootstrap.tk755.net | bash            # install dotfiles
#   curl -fsSL https://bootstrap.tk755.net | bash -s suzuki  # install + enroll suzuki

# github app and endpoints
readonly GITHUB_CLIENT_ID="Iv23lixdWKBdjBcC87TD"
readonly GITHUB_API="https://api.github.com"
readonly GITHUB_API_VERSION="2026-03-10"
readonly DEVICE_CODE_URL="https://github.com/login/device/code"
readonly ACCESS_TOKEN_URL="https://github.com/login/oauth/access_token"
readonly BOOTSTRAP_PATH="/repos/tk755/machines/contents/.bin/bootstrap?ref=main"

SPINNER=(⠋ ⠙ ⠹ ⠸ ⠼ ⠴ ⠦ ⠧ ⠇ ⠏)

# colors only on a terminal
if [[ -t 2 ]]; then
    CYAN=$'\e[36m'
    GREEN=$'\e[32m'
    BLUE=$'\e[94m'
    DIM=$'\e[2m'
    RESET=$'\e[0m'
    ERASE=$'\r\e[K'
else
    CYAN=""
    GREEN=""
    BLUE=""
    DIM=""
    RESET=""
    ERASE=""
fi

# these must never reach the curl or bootstrap environment
unset ACCESS_TOKEN BOOTSTRAP_FILE
ACCESS_TOKEN=""    # github user access token, expires in 8 hours, never written to disk
BOOTSTRAP_FILE=""  # downloaded private bootstrap, removed on exit

# remove the downloaded bootstrap on any exit, including ctrl-c
trap 'rm -f -- "${BOOTSTRAP_FILE}"' EXIT

# print an error, erasing a spinner line if one is showing, and exit
error() {
    printf '%sbootstrap: %s\n' "${ERASE}" "$*" >&2
    exit 1
}

# print a decoded field from a form-encoded body; empty if absent
form_field() {
    local key=$1 body="&$2&" value

    [[ "${body}" == *"&${key}="* ]] || return 0
    value=${body#*"&${key}="}
    value=${value%%&*}
    value=${value//+/ }
    printf '%b' "${value//%/\\x}"
}

# redraw the sign-in line with a spinner for the given seconds; plain sleep without a terminal
spin() {
    local seconds=$1 message=$2 i

    if [[ ! -t 2 ]]; then
        sleep "${seconds}"
        return
    fi

    for (( i = 0; i < seconds * 10; i++ )); do
        printf '\r  %s%s%s  %s\e[K' \
            "${CYAN}" "${SPINNER[i % ${#SPINNER[@]}]}" "${RESET}" "${message}" >&2
        sleep 0.1
    done
}

# get an api path; headers go to curl on stdin so the token never appears in argv
github_api_get() {
    local path=$1 accept=$2

    printf 'Accept: %s\nAuthorization: Bearer %s\nX-GitHub-Api-Version: %s\n' \
        "${accept}" "${ACCESS_TOKEN}" "${GITHUB_API_VERSION}" |
        # curl only skips ~/.curlrc when -q is its first argument
        curl -q -fsSL \
            --proto '=https' \
            --connect-timeout 15 \
            --max-time 60 \
            -H @- \
            "${GITHUB_API}${path}"
}

# post a form body; it goes to curl on stdin so the device code never appears in argv
github_oauth_post() {
    local url=$1 body=$2

    printf '%s' "${body}" |
        # curl only skips ~/.curlrc when -q is its first argument
        curl -q -fsS \
            --proto '=https' \
            --connect-timeout 15 \
            --max-time 60 \
            --data-binary @- \
            "${url}"
}

# print the login field of a github user json body without jq
github_login() {
    local login=$1

    [[ "${login}" == *'"login"'* ]] || return 0
    login=${login#*'"login"'}
    login=${login#*:}
    login=${login#*'"'}
    login=${login%%'"'*}
    printf '%s' "${login}"
}

# github's device flow: sets ACCESS_TOKEN and reports who signed in
authenticate_github() {
    local reply device_code user_code verification_uri interval message poll oauth_error next description user

    # request a one-time code
    reply=$(github_oauth_post "${DEVICE_CODE_URL}" "client_id=${GITHUB_CLIENT_ID}") ||
        error "could not request a GitHub sign-in code"
    device_code=$(form_field device_code "${reply}")
    user_code=$(form_field user_code "${reply}")
    verification_uri=$(form_field verification_uri "${reply}")
    interval=$(form_field interval "${reply}")
    interval=${interval:-5}
    [[ -n "${device_code}" && -n "${user_code}" && -n "${verification_uri}" ]] ||
        error "GitHub returned an invalid device-flow response"

    # show the code to enter on any phone or browser
    message="Sign in to ${BLUE}${verification_uri}${RESET} and enter ${user_code}"
    if [[ ! -t 2 ]]; then
        printf '  %s\n' "${message}" >&2
    fi

    # poll until approved, at the interval github asks for
    while true; do
        spin "${interval}" "${message}"
        poll=$(github_oauth_post \
            "${ACCESS_TOKEN_URL}" \
            "client_id=${GITHUB_CLIENT_ID}&device_code=${device_code}&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code") ||
            error "could not complete GitHub sign-in"
        ACCESS_TOKEN=$(form_field access_token "${poll}")
        [[ -z "${ACCESS_TOKEN}" ]] || break

        oauth_error=$(form_field error "${poll}")
        case "${oauth_error}" in
            authorization_pending)
                ;;
            slow_down)
                next=$(form_field interval "${poll}")
                interval=${next:-$(( interval + 5 ))}
                ;;
            '')
                error "GitHub returned an invalid access-token response"
                ;;
            *)
                description=$(form_field error_description "${poll}")
                error "${description:-GitHub sign-in failed (${oauth_error})}"
                ;;
        esac
    done

    # print signed in user; the lookup is cosmetic, so its failure is not fatal
    user=$(github_login "$(github_api_get /user application/vnd.github+json 2>/dev/null || true)")
    if [[ -n "${user}" ]]; then
        printf '%s  %s✓%s  Signed in as %s %s(temporary)%s\n' \
            "${ERASE}" "${GREEN}" "${RESET}" "${user}" "${DIM}" "${RESET}" >&2
    else
        printf '%s  %s✓%s  Signed in to GitHub %s(temporary)%s\n' \
            "${ERASE}" "${GREEN}" "${RESET}" "${DIM}" "${RESET}" >&2
    fi
}

# download the private bootstrap into a temp file and check it is a script before it can run
download_bootstrap() {
    local first_line=""

    BOOTSTRAP_FILE=$(mktemp "${TMPDIR:-/tmp}/machines-bootstrap.XXXXXX")
    github_api_get "${BOOTSTRAP_PATH}" application/vnd.github.raw+json >"${BOOTSTRAP_FILE}" ||
        error "could not download the private bootstrap"
    IFS= read -r first_line <"${BOOTSTRAP_FILE}" || true
    [[ "${first_line}" == '#!'* ]] ||
        error "downloaded bootstrap is not an executable script"
    chmod 700 "${BOOTSTRAP_FILE}"
}

# run bootstrap with the given arguments, terminal as stdin so it can prompt
run_bootstrap() {
    { exec 3</dev/tty; } 2>/dev/null ||
        error "a controlling terminal is required to run the private bootstrap"
    "${BOOTSTRAP_FILE}" ${1+"$@"} <&3
}

main() {
    command -v curl >/dev/null 2>&1 || error "curl is required"

    authenticate_github
    download_bootstrap
    run_bootstrap ${1+"$@"}
}

# compatibility with bash 3.2 on macOS
main ${1+"$@"}