#!/bin/bash
set -euo pipefail

API_BASE_URL="${BOOTSTRAP_API_URL:-https://bootstrap.run.cloud}"
POLL_RESPONSE=""
AUTH_KEY=""

cleanup() {
  AUTH_KEY=""
  if [[ -n "$POLL_RESPONSE" && -f "$POLL_RESPONSE" ]]; then
    rm -f "$POLL_RESPONSE"
  fi
}
trap cleanup EXIT

if [[ "$(uname -s)" != "Darwin" ]]; then
  echo "This bootstrap is for macOS only." >&2
  exit 1
fi

echo "run.cloud Mac enrollment"
echo "Administrator access is required to install networking and enable Remote Login."
sudo -v </dev/tty

if ! command -v brew >/dev/null 2>&1; then
  NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
fi

if [[ -x /opt/homebrew/bin/brew ]]; then
  BREW=/opt/homebrew/bin/brew
elif [[ -x /usr/local/bin/brew ]]; then
  BREW=/usr/local/bin/brew
else
  BREW="$(command -v brew)"
fi
eval "$($BREW shellenv)"

"$BREW" install tailscale jq qrencode
sudo "$BREW" services start tailscale

HOSTNAME_VALUE="$(scutil --get LocalHostName 2>/dev/null || hostname -s)"
LOCAL_HOSTNAME="$(scutil --get ComputerName 2>/dev/null || hostname)"
MODEL="$(sysctl -n hw.model 2>/dev/null || true)"
OS_VERSION="$(sw_vers -productVersion)"
ARCHITECTURE="$(uname -m)"

json_escape() {
  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
}

CREATE_BODY="$(printf '{"hostname":"%s","localHostname":"%s","model":"%s","osVersion":"%s","architecture":"%s"}'   "$(json_escape "$HOSTNAME_VALUE")"   "$(json_escape "$LOCAL_HOSTNAME")"   "$(json_escape "$MODEL")"   "$(json_escape "$OS_VERSION")"   "$(json_escape "$ARCHITECTURE")")"

CREATE_RESPONSE="$(curl -fsS   -H 'content-type: application/json'   --data-binary "$CREATE_BODY"   "$API_BASE_URL/fleet/enrollments")"

ENROLLMENT_ID="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.id')"
POLL_TOKEN="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.pollToken')"
USER_CODE="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.userCode')"
VERIFY_URL="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.verificationUrl')"
EXPIRES_AT="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.expiresAt')"

echo
echo "Approve this Mac on your phone:"
echo "$VERIFY_URL"
echo
qrencode -t ANSIUTF8 "$VERIFY_URL" || true
echo
echo "Confirmation code: $USER_CODE"
echo "Expires: $EXPIRES_AT"
echo "Waiting for approval..."

POLL_RESPONSE="$(mktemp -t run-cloud-enrollment.XXXXXX)"
while true; do
  HTTP_STATUS="$(curl -sS     -o "$POLL_RESPONSE"     -w '%{http_code}'     -H "authorization: Bearer $POLL_TOKEN"     "$API_BASE_URL/fleet/enrollments/$ENROLLMENT_ID/poll")"

  if [[ "$HTTP_STATUS" == "200" ]]; then
    STATUS="$(jq -er '.status' "$POLL_RESPONSE")"
    if [[ "$STATUS" == "approved" ]]; then
      AUTH_KEY="$(jq -er '.authKey' "$POLL_RESPONSE")"
      break
    fi
    if [[ "$STATUS" == "rejected" || "$STATUS" == "expired" ]]; then
      echo "Enrollment $STATUS." >&2
      exit 1
    fi
  elif [[ "$HTTP_STATUS" == "410" ]]; then
    echo "Enrollment expired or was already consumed. Start the bootstrap again." >&2
    exit 1
  elif [[ "$HTTP_STATUS" != "202" ]]; then
    echo "Enrollment poll failed (HTTP $HTTP_STATUS)." >&2
    exit 1
  fi
  sleep 2
done

echo "Approved. Joining the tailnet..."
sudo tailscale up --auth-key="$AUTH_KEY" --hostname="$HOSTNAME_VALUE" --ssh
AUTH_KEY=""

sudo systemsetup -setremotelogin on >/dev/null

mkdir -p "$HOME/.ssh"
chmod 700 "$HOME/.ssh"
touch "$HOME/.ssh/authorized_keys"
chmod 600 "$HOME/.ssh/authorized_keys"
while IFS= read -r public_key; do
  [[ -z "$public_key" ]] && continue
  grep -qxF -- "$public_key" "$HOME/.ssh/authorized_keys" || printf '%s\n' "$public_key" >> "$HOME/.ssh/authorized_keys"
done < <(jq -r '.sshPublicKeys[]?' "$POLL_RESPONSE")

curl -fsS   -X POST   -H "authorization: Bearer $POLL_TOKEN"   "$API_BASE_URL/fleet/enrollments/$ENROLLMENT_ID/complete" >/dev/null

TAILSCALE_IP="$(tailscale ip -4 | head -n 1)"
echo
echo "Enrollment complete."
echo "Remote Login: $(sudo systemsetup -getremotelogin)"
echo "Tailscale IP: $TAILSCALE_IP"
echo "Connect with: ssh $(id -un)@$HOSTNAME_VALUE"