#!/bin/bash
# LibrePortal backup-engine installer helper — the only root-privileged install of
# the restic/kopia binaries the manager may trigger (they're installed on demand
# when a backup location is first set up). Installed root:root 0755 to
# /usr/local/lib/libreportal/ by init.sh. Self-contained: it does the WHOLE install itself
# (package manager or signed-release download) for a FIXED, validated engine name,
# so the scoped sudoers needn't grant blanket `sudo apt-get`/`sudo install`
# (both root-equivalent — install writes anywhere, apt runs maintainer scripts).

set -u

[[ $EUID -eq 0 ]] || { echo "libreportal-bininstall: must run as root" >&2; exit 1; }

action="${1:-}"
engine="${2:-}"
[[ "$action" == "install" ]] || { echo "usage: libreportal-bininstall install <restic|kopia>" >&2; exit 2; }
case "$engine" in
    restic|kopia) ;;
    *) echo "libreportal-bininstall: unknown engine '$engine'" >&2; exit 2 ;;
esac

arch=$(uname -m)

install_restic() {
    command -v restic >/dev/null 2>&1 && return 0
    if command -v apt-get >/dev/null 2>&1; then
        apt-get update -qq >/dev/null 2>&1
        if apt-get install -y restic >/dev/null 2>&1; then
            restic self-update >/dev/null 2>&1 || true
            return 0
        fi
    elif command -v dnf >/dev/null 2>&1; then
        dnf install -y restic >/dev/null 2>&1 && return 0
    elif command -v pacman >/dev/null 2>&1; then
        pacman -S --noconfirm restic >/dev/null 2>&1 && return 0
    fi
    local a
    case "$arch" in
        x86_64) a=amd64 ;; aarch64) a=arm64 ;; armv7l) a=arm ;;
        *) echo "libreportal-bininstall: unsupported arch '$arch'" >&2; return 1 ;;
    esac
    local tmp; tmp=$(mktemp -d)
    if curl -sL "https://github.com/restic/restic/releases/latest/download/restic_linux_${a}.bz2" -o "$tmp/restic.bz2" \
       && bunzip2 "$tmp/restic.bz2" \
       && install -m 0755 "$tmp/restic" /usr/local/bin/restic; then
        rm -rf "$tmp"; return 0
    fi
    rm -rf "$tmp"; echo "libreportal-bininstall: restic download failed" >&2; return 1
}

install_kopia() {
    command -v kopia >/dev/null 2>&1 && return 0
    local a
    case "$arch" in
        x86_64) a=x64 ;; aarch64) a=arm64 ;; armv7l) a=arm ;;
        *) echo "libreportal-bininstall: unsupported arch '$arch'" >&2; return 1 ;;
    esac
    local version
    version=$(curl -sL https://api.github.com/repos/kopia/kopia/releases/latest 2>/dev/null \
        | grep -oE '"tag_name":[[:space:]]*"v[0-9.]+"' | head -1 | grep -oE '[0-9.]+')
    [[ -n "$version" ]] || { echo "libreportal-bininstall: kopia version lookup failed" >&2; return 1; }
    local url="https://github.com/kopia/kopia/releases/download/v${version}/kopia-${version}-linux-${a}.tar.gz"
    local tmp; tmp=$(mktemp -d)
    if curl -sL "$url" -o "$tmp/kopia.tgz" && tar xzf "$tmp/kopia.tgz" -C "$tmp"; then
        local bin; bin=$(find "$tmp" -name kopia -type f -executable | head -1)
        if [[ -n "$bin" ]] && install -m 0755 "$bin" /usr/local/bin/kopia; then
            rm -rf "$tmp"; return 0
        fi
    fi
    rm -rf "$tmp"; echo "libreportal-bininstall: kopia install failed" >&2; return 1
}

case "$engine" in
    restic) install_restic ;;
    kopia)  install_kopia ;;
esac