#!/bin/bash
set -euo pipefail

API_BASE_URL="${BOOTSTRAP_API_URL:-https://bootstrap.run.cloud}"
BOOTSTRAP_VERSION="2026-08-21.1"
APPROVAL_FILE="${BOOTSTRAP_APPROVAL_FILE:-}"
APPROVAL_FILE_CREATED="0"
POLL_RESPONSE=""
AUTH_KEY=""

cleanup() {
  AUTH_KEY=""
  if [[ -n "$POLL_RESPONSE" && -f "$POLL_RESPONSE" ]]; then
    rm -f "$POLL_RESPONSE"
  fi
  if [[ "$APPROVAL_FILE_CREATED" == "1" && -n "$APPROVAL_FILE" ]]; then
    rm -f "$APPROVAL_FILE"
  fi
}
trap cleanup EXIT

if [[ "$(uname -s)" != "Darwin" ]]; then
  echo "This bootstrap is for macOS only." >&2
  exit 1
fi

echo "run.cloud Mac enrollment"
echo "Bootstrap version: $BOOTSTRAP_VERSION"
echo "Administrator access is required to install networking and enable Remote Login."
if ! sudo -n -v >/dev/null 2>&1; then
  sudo -v </dev/tty
fi

if ! command -v brew >/dev/null 2>&1; then
  NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" </dev/null
fi

if [[ -x /opt/homebrew/bin/brew ]]; then
  BREW=/opt/homebrew/bin/brew
elif [[ -x /usr/local/bin/brew ]]; then
  BREW=/usr/local/bin/brew
else
  BREW="$(command -v brew)"
fi
export HOMEBREW_NO_ASK=1
export HOMEBREW_NO_AUTO_UPDATE=1
eval "$("$BREW" shellenv </dev/null)"

HOMEBREW_NO_AUTO_UPDATE=1 HOMEBREW_NO_ASK=1 "$BREW" install tailscale jq qrencode </dev/null
sudo "$BREW" services start tailscale </dev/null

TAILSCALE_BIN="$(command -v tailscale)"
HOSTNAME_VALUE="${TAILSCALE_HOSTNAME:-$(scutil --get LocalHostName 2>/dev/null || hostname -s)}"
LOCAL_HOSTNAME="$(scutil --get ComputerName 2>/dev/null || hostname)"
MODEL="$(sysctl -n hw.model 2>/dev/null || true)"
OS_VERSION="$(sw_vers -productVersion)"
ARCHITECTURE="$(uname -m)"

enable_remote_access() {
  sudo /usr/sbin/systemsetup -setremotelogin on >/dev/null
}

report_success() {
  local result="$1"
  local dns_name
  dns_name="$(sudo "$TAILSCALE_BIN" status --json 2>/dev/null | jq -er '.Self.DNSName // .Self.HostName')"
  echo
  echo "Enrollment complete."
  echo "Bootstrap version: $BOOTSTRAP_VERSION"
  echo "Bootstrap result: $result"
  echo "Remote Login: $(sudo /usr/sbin/systemsetup -getremotelogin)"
  echo "Tailscale node: $dns_name"
  echo "Tailnet status: connected"
  echo "Connect with: ssh $(id -un)@$HOSTNAME_VALUE"
}

if sudo "$TAILSCALE_BIN" status --json 2>/dev/null | jq -e '
  .BackendState == "Running" and .Self.Online == true
' >/dev/null; then
  sudo "$TAILSCALE_BIN" set --hostname="$HOSTNAME_VALUE" --ssh
  enable_remote_access
  report_success "already-healthy"
  exit 0
fi

json_escape() {
  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
}

CREATE_BODY="$(printf '{"platform":"macos","hostname":"%s","localHostname":"%s","model":"%s","osVersion":"%s","architecture":"%s"}'   "$(json_escape "$HOSTNAME_VALUE")"   "$(json_escape "$LOCAL_HOSTNAME")"   "$(json_escape "$MODEL")"   "$(json_escape "$OS_VERSION")"   "$(json_escape "$ARCHITECTURE")")"

CREATE_RESPONSE="$(curl -fsS   -H 'content-type: application/json'   --data-binary "$CREATE_BODY"   "$API_BASE_URL/fleet/enrollments")"

ENROLLMENT_ID="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.id')"
POLL_TOKEN="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.pollToken')"
USER_CODE="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.userCode')"
VERIFY_URL="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.verificationUrl')"
EXPIRES_AT="$(printf '%s' "$CREATE_RESPONSE" | jq -er '.expiresAt')"

echo
if [[ -n "$APPROVAL_FILE" ]]; then
  umask 077
  {
    printf 'verificationUrl=%s
' "$VERIFY_URL"
    printf 'userCode=%s
' "$USER_CODE"
    printf 'expiresAt=%s
' "$EXPIRES_AT"
  } > "$APPROVAL_FILE"
  chmod 600 "$APPROVAL_FILE"
  APPROVAL_FILE_CREATED="1"
  echo "Approval details are available in the requested private file."
else
  echo "Approve this Mac on your phone:"
  echo "$VERIFY_URL"
  echo
  qrencode -t ANSIUTF8 "$VERIFY_URL" || true
  echo
  echo "Confirmation code: $USER_CODE"
  echo "Expires: $EXPIRES_AT"
fi
echo "Waiting for approval..."

POLL_RESPONSE="$(mktemp -t run-cloud-enrollment.XXXXXX)"
while true; do
  HTTP_STATUS="$(curl -sS     -o "$POLL_RESPONSE"     -w '%{http_code}'     -H "authorization: Bearer $POLL_TOKEN"     "$API_BASE_URL/fleet/enrollments/$ENROLLMENT_ID/poll")"

  if [[ "$HTTP_STATUS" == "200" ]]; then
    STATUS="$(jq -er '.status' "$POLL_RESPONSE")"
    if [[ "$STATUS" == "approved" ]]; then
      AUTH_KEY="$(jq -er '.authKey' "$POLL_RESPONSE")"
      break
    fi
    if [[ "$STATUS" == "rejected" || "$STATUS" == "expired" ]]; then
      echo "Enrollment $STATUS." >&2
      exit 1
    fi
  elif [[ "$HTTP_STATUS" == "410" ]]; then
    echo "Enrollment expired or was already consumed. Start the bootstrap again." >&2
    exit 1
  elif [[ "$HTTP_STATUS" != "202" ]]; then
    echo "Enrollment poll failed (HTTP $HTTP_STATUS)." >&2
    exit 1
  fi
  sleep 2
done

echo "Approved. Joining the tailnet..."
sudo "$TAILSCALE_BIN" up --auth-key="$AUTH_KEY" --hostname="$HOSTNAME_VALUE" --ssh
AUTH_KEY=""

enable_remote_access

mkdir -p "$HOME/.ssh"
chmod 700 "$HOME/.ssh"
touch "$HOME/.ssh/authorized_keys"
chmod 600 "$HOME/.ssh/authorized_keys"
while IFS= read -r public_key; do
  [[ -z "$public_key" ]] && continue
  grep -qxF -- "$public_key" "$HOME/.ssh/authorized_keys" || printf '%s\n' "$public_key" >> "$HOME/.ssh/authorized_keys"
done < <(jq -r '.sshPublicKeys[]?' "$POLL_RESPONSE")

curl -fsS   -X POST   -H "authorization: Bearer $POLL_TOKEN"   "$API_BASE_URL/fleet/enrollments/$ENROLLMENT_ID/complete" >/dev/null

if ! sudo "$TAILSCALE_BIN" status --json 2>/dev/null | jq -e --arg hostname "$HOSTNAME_VALUE" '
  .BackendState == "Running" and
  .Self.Online == true and
  (.Self.HostName | ascii_downcase) == ($hostname | ascii_downcase)
' >/dev/null; then
  echo "Tailscale did not report a healthy node with the requested hostname." >&2
  exit 1
fi

report_success "enrolled"