#!/bin/sh
# Quickstart 1028-0.17.1-rc20261028: default to read-only inspection.
set -eu

RELEASE_URL='https://fw.koolcenter.com/iStoreOS/alpha/quickstart/1028-0.17.1-rc20261028'
MODE=check
BACKUP_FILE=
fail() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
usage() {
    cat <<'EOF'
Quickstart 1028-0.17.1-rc20261028 (Alpha)
  sh install_quickstart.sh --check
  sh install_quickstart.sh --install --backup-file /mnt/EXTERNAL/system-backup.tar.gz

Default: read-only inspection, without downloads, index updates or installation.
Installation requires an existing full-system backup on external storage and
two interactive confirmations. Downloaded packages and logs are retained.
EOF
}
while [ "$#" -gt 0 ]; do
    case "$1" in
        --check) MODE=check; shift ;;
        --install) MODE=install; shift ;;
        --backup-file)
            [ "$#" -ge 2 ] || fail '--backup-file needs a path'
            BACKUP_FILE=$2; shift 2 ;;
        --help|-h) usage; exit 0 ;;
        *) fail "Unknown argument: $1" ;;
    esac
done

MACHINE=$(uname -m)
case "$MACHINE" in
    aarch64|arm64) ARCH=arm64 ;;
    x86_64|amd64) ARCH=x86_64 ;;
    *) fail "Unsupported architecture: $MACHINE" ;;
esac
HAS_OPKG=0
HAS_APK=0
if command -v opkg >/dev/null 2>&1 &&
    opkg status base-files 2>/dev/null | grep -q '^Status: .* installed$'; then
    HAS_OPKG=1
fi
if command -v apk >/dev/null 2>&1 && apk info -e base-files >/dev/null 2>&1; then
    HAS_APK=1
fi
case "$HAS_OPKG/$HAS_APK" in
    1/0) FORMAT=ipk ;;
    0/1) FORMAT=apk ;;
    *) fail "Ambiguous/invalid package databases: opkg=$HAS_OPKG apk=$HAS_APK" ;;
esac

case "$ARCH/$FORMAT" in
    x86_64/ipk)
        QS_FILE=quickstart_0.17.1-rc20261028-1_x86_64.ipk
        QS_VERSION=0.17.1-rc20261028-1
        QS_SHA=24c58356d4eedcb9314dcb3479e94fa7e740a9df5b45020a11c9d3e374d0f5ac
        NP_FILE=quickstart-netpolicy_0.2.0-test20260928-3_x86_64.ipk
        NP_VERSION=0.2.0-test20260928-3
        NP_SHA=13c1113e1115c2f63b352ae3e0c90beb4ac710387ae8d52672469bc906cbe54f
        UI_FILE=luci-app-quickstart_0.17.1-rc20261028-r1_all.ipk
        UI_VERSION=0.17.1-rc20261028-r1
        UI_SHA=9b14885f3e26a87f966e14844d3187838cafa8ae284b2a45c0474546ec1de034
        ;;
    x86_64/apk)
        QS_FILE=quickstart-0.17.1_rc20261028-r1.apk
        QS_VERSION=0.17.1_rc20261028-r1
        QS_SHA=26dc71f386460fd4bacc494c93868dff9b86407273235b2e0bea9a3d2e7a67e4
        NP_FILE=quickstart-netpolicy-0.2.0_git20260928-r3.apk
        NP_VERSION=0.2.0_git20260928-r3
        NP_SHA=99d949d6bf7731737fa2057091f76e6b8a1e65c01127de830eee7c24095489b4
        UI_FILE=luci-app-quickstart-0.17.1_rc20261028-r1.apk
        UI_VERSION=0.17.1_rc20261028-r1
        UI_SHA=e4beb67b0391f580e4569835fffc399da94204b0261ec784dff84eafcf0e5a08
        ;;
    arm64/ipk)
        QS_FILE=quickstart_0.17.1-rc20261028-r1_aarch64_generic.ipk
        QS_VERSION=0.17.1-rc20261028-r1
        QS_SHA=8f0bc788dd594a5180e68493b5769509a24443a678e7500eaa6abd9b043e8ffa
        NP_FILE=quickstart-netpolicy_0.2.0-test20260928-r3_aarch64_generic.ipk
        NP_VERSION=0.2.0-test20260928-r3
        NP_SHA=94769586beda39850027bfcd45fa9cc07c6acd516b01d582995841802807fcab
        UI_FILE=luci-app-quickstart_0.17.1-rc20261028-r1_all.ipk
        UI_VERSION=0.17.1-rc20261028-r1
        UI_SHA=1f243d9be2b24dba45b51a5675e1587d9768f5802552bad18e92f4e7c0819d3e
        ;;
    arm64/apk)
        QS_FILE=quickstart-0.17.1_rc20261028-r1.apk
        QS_VERSION=0.17.1_rc20261028-r1
        QS_SHA=466854aa2b008f7c8a6a72eb5c806f85dec24da8034ecb3e3b2830b103a06703
        NP_FILE=quickstart-netpolicy-0.2.0_git20260928-r3.apk
        NP_VERSION=0.2.0_git20260928-r3
        NP_SHA=ef86b2b834f6858e5fb9cd0cd511713ab9bb7c4e76d13f3c00dcaec124b845f2
        UI_FILE=luci-app-quickstart-0.17.1_rc20261028-r1.apk
        UI_VERSION=0.17.1_rc20261028-r1
        UI_SHA=e4beb67b0391f580e4569835fffc399da94204b0261ec784dff84eafcf0e5a08
        ;;
esac
DOWNLOAD_URL=$RELEASE_URL/$ARCH/$FORMAT
printf 'Architecture: %s -> %s\nPackage format: %s\nDownload: %s/\n' "$MACHINE" "$ARCH" "$FORMAT" "$DOWNLOAD_URL"
printf 'Targets:\n  %s\n  %s\n  %s\n' "$QS_FILE" "$NP_FILE" "$UI_FILE"
printf 'Current packages:\n'
if [ "$FORMAT" = ipk ]; then
    opkg list-installed | grep -E '^(quickstart|quickstart-netpolicy|luci-app-quickstart) - ' || true
else
    apk list --installed quickstart quickstart-netpolicy luci-app-quickstart || true
fi
if command -v quickstart >/dev/null 2>&1; then quickstart version || true; fi
df -h / /tmp
if [ "$MODE" = check ]; then
    printf 'Read-only check complete. Use --install --backup-file PATH to install.\n'
    exit 0
fi

[ "$(id -u)" = 0 ] || fail 'Installation requires root'
[ -n "$BACKUP_FILE" ] && [ -f "$BACKUP_FILE" ] && [ -s "$BACKUP_FILE" ] ||
    fail 'Provide an existing, nonempty full-system backup with --backup-file'
BACKUP_FILE=$(readlink -f "$BACKUP_FILE")
BACKUP_MOUNT=$(df -P "$BACKUP_FILE" | awk 'NR==2 {print $NF}')
case "$BACKUP_MOUNT" in
    ''|/|/tmp|/overlay|/ext_overlay|/rom) fail 'The full-system backup must be on external storage' ;;
esac
command -v curl >/dev/null 2>&1 || fail 'curl with HTTPS certificate support is required'
command -v sha256sum >/dev/null 2>&1 || fail 'sha256sum is required'
confirm() {
    printf '%s Type INSTALL to continue: ' "$1"
    ANSWER=
    if ! read -r ANSWER </dev/tty; then fail 'Interactive confirmation is required'; fi
    [ "$ANSWER" = INSTALL ] || fail 'Cancelled; existing files are retained'
}
printf 'Full-system backup: %s (mount: %s)\n' "$BACKUP_FILE" "$BACKUP_MOUNT"
confirm 'Confirm that this is a valid full-system backup. Update indexes and download these Alpha packages?'
if [ "$FORMAT" = ipk ]; then opkg update; else apk update; fi
WORK=$(mktemp -d /tmp/quickstart-1028-0.17.1-rc20261028.XXXXXX)
printf 'Keeping downloaded files and logs in %s\n' "$WORK"
cd "$WORK"
for FILE in "$QS_FILE" "$NP_FILE" "$UI_FILE"; do
    curl --fail --location --silent --show-error --proto '=https' --proto-redir '=https' \
        --connect-timeout 20 --max-time 300 "$DOWNLOAD_URL/$FILE" --output "$FILE"
    [ -s "$FILE" ] || fail "Empty download: $FILE"
done
printf '%s  %s\n%s  %s\n%s  %s\n' \
    "$QS_SHA" "$QS_FILE" "$NP_SHA" "$NP_FILE" "$UI_SHA" "$UI_FILE" >SHA256SUMS
sha256sum -c SHA256SUMS
ls -lh "$QS_FILE" "$NP_FILE" "$UI_FILE"
cat SHA256SUMS
df -h / /tmp
if [ "$FORMAT" = ipk ]; then
    if opkg --noaction install "./$QS_FILE" "./$NP_FILE" "./$UI_FILE" >preflight.log 2>&1; then
        cat preflight.log
    else cat preflight.log; fail 'Dependency/architecture preflight failed'; fi
else
    if apk add --simulate --allow-untrusted "./$QS_FILE" "./$NP_FILE" "./$UI_FILE" >preflight.log 2>&1; then
        cat preflight.log
    else cat preflight.log; fail 'Dependency/architecture preflight failed'; fi
fi
confirm 'SHA256 and dependency preflight passed. Install backend/netpolicy, then LuCI?'
if [ "$FORMAT" = ipk ]; then
    opkg install "./$QS_FILE" "./$NP_FILE" >install-runtime.log 2>&1 || {
        cat install-runtime.log; fail 'Runtime installation failed; LuCI was not installed'; }
    cat install-runtime.log
    opkg install "./$UI_FILE" >install-luci.log 2>&1 || {
        cat install-luci.log; fail 'LuCI installation failed'; }
else
    apk add --allow-untrusted "./$QS_FILE" "./$NP_FILE" >install-runtime.log 2>&1 || {
        cat install-runtime.log; fail 'Runtime installation failed; LuCI was not installed'; }
    cat install-runtime.log
    apk add --allow-untrusted "./$UI_FILE" >install-luci.log 2>&1 || {
        cat install-luci.log; fail 'LuCI installation failed'; }
fi
cat install-luci.log
check_version() {
    PACKAGE=$1 EXPECTED=$2
    if [ "$FORMAT" = ipk ]; then
        ACTUAL=$(opkg status "$PACKAGE" | awk '/^Version: / {print $2}')
        opkg status "$PACKAGE" | grep -q '^Status: .* installed$' || fail "$PACKAGE is not installed"
        [ "$ACTUAL" = "$EXPECTED" ] || fail "$PACKAGE version mismatch: $ACTUAL, expected $EXPECTED"
    else
        apk info -e "$PACKAGE=$EXPECTED" >/dev/null ||
            fail "$PACKAGE version mismatch: expected $EXPECTED"
    fi
    printf 'Verified installed: %s %s\n' "$PACKAGE" "$EXPECTED"
}
check_version quickstart "$QS_VERSION"
check_version quickstart-netpolicy "$NP_VERSION"
check_version luci-app-quickstart "$UI_VERSION"
quickstart version
if [ -x /etc/init.d/quickstart ]; then /etc/init.d/quickstart status; fi
printf 'Package installation verified. Verify authenticated homepage and /lanctrl/v2/devices/ before accepting business functionality.\n'