#!/usr/bin/env bash
# AUR-Shield Client Installer
# Configures pacman to use the AUR-Shield repo
set -euo pipefail

SHIELD_HOST="${AUR_SHIELD_HOST:-localhost}"
SHIELD_PORT="${AUR_SHIELD_PORT:-8443}"

echo "╔══════════════════════════════════════════════╗"
echo "║        AUR-Shield Client Installer           ║"
echo "╚══════════════════════════════════════════════╝"
echo ""

if ! command -v pacman &>/dev/null; then
    echo "✗ This script requires Arch Linux (pacman)."
    exit 1
fi

echo "Server: http://$SHIELD_HOST:$SHIELD_PORT"
echo ""

# Add pacman repo
PACMAN_CONF="/etc/pacman.conf"
REPO_ENTRY="[aur-shield]
Server = http://$SHIELD_HOST:$SHIELD_PORT/repo
SigLevel = Never"

if grep -q "^\[aur-shield\]" "$PACMAN_CONF"; then
    echo "⚠ [aur-shield] already exists in $PACMAN_CONF — skipping"
else
    echo "Adding [aur-shield] to $PACMAN_CONF..."
    sudo tee -a "$PACMAN_CONF" > /dev/null << EOF

# AUR-Shield — AI-scanned AUR packages
$REPO_ENTRY
EOF
    echo "✓ Added repo entry"
fi

# Install safe-yay wrapper
WRAPPER_PATH="/usr/local/bin/safe-yay"
echo "Installing safe-yay wrapper to $WRAPPER_PATH..."

sudo tee "$WRAPPER_PATH" > /dev/null << 'WRAPPER'
#!/usr/bin/env bash
# safe-yay — wrapper that routes AUR packages through AUR-Shield
set -euo pipefail

SHIELD_HOST="${AUR_SHIELD_HOST:-localhost}"
SHIELD_PORT="${AUR_SHIELD_PORT:-8443}"

if [ $# -eq 0 ]; then
    echo "Usage: safe-yay <package> [package2 ...]"
    echo "Scans and builds AUR packages through AUR-Shield"
    exit 0
fi

for pkg in "$@"; do
    echo "→ Processing $pkg..."
    
    # Call AUR-Shield to scan + build
    RESPONSE=$(curl -sf "http://$SHIELD_HOST:$SHIELD_PORT/api/build/$pkg" 2>&1) || {
        echo "✗ Failed to process $pkg"
        echo "  $RESPONSE"
        continue
    }
    
    # Extract verdict
    VERDICT=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.loads(sys.stdin.read()).get('verdict','error'))" 2>/dev/null)
    
    case "$VERDICT" in
        clean)
            echo "  ✓ Clean — package built and added to repo"
            ;;
        suspicious)
            echo "  ⚠ Suspicious — package built but review recommended"
            echo "  Report: http://$SHIELD_HOST:$SHIELD_PORT/api/report/$pkg"
            ;;
        malicious)
            echo "  ✗ MALICIOUS — package blocked!"
            echo "  Report: http://$SHIELD_HOST:$SHIELD_PORT/api/report/$pkg"
            continue
            ;;
        *)
            echo "  ? Error: $RESPONSE"
            continue
            ;;
    esac
    
    # Now install via pacman
    echo "  Installing via pacman..."
    sudo pacman -Sy "aur-shield/$pkg" || {
        echo "  ⚠ Package not in repo yet — may need to wait for build"
    }
done

echo "Done."
WRAPPER

sudo chmod +x "$WRAPPER_PATH"
echo "✓ Installed safe-yay"

echo ""
echo "╔══════════════════════════════════════════════╗"
echo "║  Client setup complete!                      ║"
echo "╠══════════════════════════════════════════════╣"
echo "║                                              ║"
echo "║  Usage:                                      ║"
echo "║    safe-yay <package>                         ║"
echo "║    sudo pacman -S aur-shield/<package>        ║"
echo "║                                              ║"
echo "║  Set server via env:                         ║"
echo "║    export AUR_SHIELD_HOST=10.90.9.102        ║"
echo "║    export AUR_SHIELD_PORT=8443               ║"
echo "║                                              ║"
echo "╚══════════════════════════════════════════════╝"