#!/bin/sh
# Quickstart 1113-0.17.1-rc20261028-r2: default to read-only inspection.
set -eu

RELEASE_URL='https://fw.koolcenter.com/iStoreOS/alpha/quickstart/1113-0.17.1-rc20261028-r2'
MODE=check
BACKUP_FILE=
fail() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
usage() {
    cat <<'EOF'
Quickstart 1113-0.17.1-rc20261028-r2 (Alpha)
  sh install_quickstart.sh --check
  sh install_quickstart.sh --install --backup-file /mnt/EXTERNAL/system-backup.tar.gz

Default: read-only inspection, without downloads, index updates or installation.
Installation requires an existing full-system backup on external storage and
two interactive confirmations. Downloaded packages and logs are retained.
EOF
}
while [ "$#" -gt 0 ]; do
    case "$1" in
        --check) MODE=check; shift ;;
        --install) MODE=install; shift ;;
        --backup-file)
            [ "$#" -ge 2 ] || fail '--backup-file needs a path'
            BACKUP_FILE=$2; shift 2 ;;
        --help|-h) usage; exit 0 ;;
        *) fail "Unknown argument: $1" ;;
    esac
done

MACHINE=$(uname -m)
case "$MACHINE" in
    aarch64|arm64) ARCH=arm64 ;;
    x86_64|amd64) ARCH=x86_64 ;;
    *) fail "Unsupported architecture: $MACHINE" ;;
esac
HAS_OPKG=0
HAS_APK=0
if command -v opkg >/dev/null 2>&1 &&
    opkg status base-files 2>/dev/null | grep -q '^Status: .* installed$'; then
    HAS_OPKG=1
fi
if command -v apk >/dev/null 2>&1 && apk info -e base-files >/dev/null 2>&1; then
    HAS_APK=1
fi
case "$HAS_OPKG/$HAS_APK" in
    1/0) FORMAT=ipk ;;
    0/1) FORMAT=apk ;;
    *) fail "Ambiguous/invalid package databases: opkg=$HAS_OPKG apk=$HAS_APK" ;;
esac

case "$ARCH/$FORMAT" in
    x86_64/ipk)
        QS_FILE=quickstart_0.17.1-rc20261028-2_x86_64.ipk
        QS_VERSION=0.17.1-rc20261028-2
        QS_SHA=9f6c9b2e626649de92a739d36a1dbdcb38af1afeead3713fff22f1da6f68b314
        NP_FILE=quickstart-netpolicy_0.2.1-rc20261113-1_x86_64.ipk
        NP_VERSION=0.2.1-rc20261113-1
        NP_SHA=44fced203d163d0a68857449b8b998720622bdc85e7dadfce411bf750d1d804f
        UI_FILE=luci-app-quickstart_0.17.1-rc20261028-r2_all.ipk
        UI_VERSION=0.17.1-rc20261028-r2
        UI_SHA=642b8da52df2d361fd0510c67f1690b90f1b604e319e8ba8c8d4346af67c44fc
        ;;
    x86_64/apk)
        QS_FILE=quickstart-0.17.1_rc20261028-r2.apk
        QS_VERSION=0.17.1_rc20261028-r2
        QS_SHA=7b30a9058fb7df78bb683f14ea1af7196f8e7ec65187e877664ed08de92e8e45
        NP_FILE=quickstart-netpolicy-0.2.1_rc20261113-r1.apk
        NP_VERSION=0.2.1_rc20261113-r1
        NP_SHA=07e5f9efd9ee4c65555ab89d8a4e2a0342a4079af8e6ff0fec978bd892649c95
        UI_FILE=luci-app-quickstart-0.17.1_rc20261028-r2.apk
        UI_VERSION=0.17.1_rc20261028-r2
        UI_SHA=16c8f522fc31c9b18dfc85b4549efd7abe2ff2bb3d43290c37f362f36cb9a8f0
        ;;
    arm64/ipk)
        QS_FILE=quickstart_0.17.1-rc20261028-r2_aarch64_generic.ipk
        QS_VERSION=0.17.1-rc20261028-r2
        QS_SHA=77617a8e94756c9969dc5d04b57ba19dd233a972acf57d022de4219b2c838dae
        NP_FILE=quickstart-netpolicy_0.2.1-rc20261113-r1_aarch64_generic.ipk
        NP_VERSION=0.2.1-rc20261113-r1
        NP_SHA=2bf91ac39efc88a3fac030af0ea5c69b2ff05587885c8ccd9a0def25358436c2
        UI_FILE=luci-app-quickstart_0.17.1-rc20261028-r2_all.ipk
        UI_VERSION=0.17.1-rc20261028-r2
        UI_SHA=3b58ec4e6381d1fdfb1d80970c3728970128ae5d9d55d3d375615752478fecd7
        ;;
    arm64/apk)
        QS_FILE=quickstart-0.17.1_rc20261028-r2.apk
        QS_VERSION=0.17.1_rc20261028-r2
        QS_SHA=04c0a786bdad0198201a9845b70d707d9e2544efed7fed48f92a46691413d994
        NP_FILE=quickstart-netpolicy-0.2.1_rc20261113-r1.apk
        NP_VERSION=0.2.1_rc20261113-r1
        NP_SHA=25bb690844a20ad66ce9af68308ad5f652f1789312320cc66af4d4376cc0b10d
        UI_FILE=luci-app-quickstart-0.17.1_rc20261028-r2.apk
        UI_VERSION=0.17.1_rc20261028-r2
        UI_SHA=16c8f522fc31c9b18dfc85b4549efd7abe2ff2bb3d43290c37f362f36cb9a8f0
        ;;
esac
DOWNLOAD_URL=$RELEASE_URL/$ARCH/$FORMAT
printf 'Architecture: %s -> %s\nPackage format: %s\nDownload: %s/\n' "$MACHINE" "$ARCH" "$FORMAT" "$DOWNLOAD_URL"
printf 'Targets:\n  %s\n  %s\n  %s\n' "$QS_FILE" "$NP_FILE" "$UI_FILE"
printf 'Current packages:\n'
if [ "$FORMAT" = ipk ]; then
    opkg list-installed | grep -E '^(quickstart|quickstart-netpolicy|luci-app-quickstart) - ' || true
else
    apk list --installed quickstart quickstart-netpolicy luci-app-quickstart || true
fi
if command -v quickstart >/dev/null 2>&1; then quickstart version || true; fi
df -h / /tmp
if [ "$MODE" = check ]; then
    printf 'Read-only check complete. Use --install --backup-file PATH to install.\n'
    exit 0
fi

[ "$(id -u)" = 0 ] || fail 'Installation requires root'
[ -n "$BACKUP_FILE" ] && [ -f "$BACKUP_FILE" ] && [ -s "$BACKUP_FILE" ] ||
    fail 'Provide an existing, nonempty full-system backup with --backup-file'
BACKUP_FILE=$(readlink -f "$BACKUP_FILE")
BACKUP_MOUNT=$(df -P "$BACKUP_FILE" | awk 'NR==2 {print $NF}')
case "$BACKUP_MOUNT" in
    ''|/|/tmp|/overlay|/ext_overlay|/rom) fail 'The full-system backup must be on external storage' ;;
esac
command -v curl >/dev/null 2>&1 || fail 'curl with HTTPS certificate support is required'
command -v sha256sum >/dev/null 2>&1 || fail 'sha256sum is required'
confirm() {
    printf '%s Type INSTALL to continue: ' "$1"
    ANSWER=
    if ! read -r ANSWER </dev/tty; then fail 'Interactive confirmation is required'; fi
    [ "$ANSWER" = INSTALL ] || fail 'Cancelled; existing files are retained'
}
printf 'Full-system backup: %s (mount: %s)\n' "$BACKUP_FILE" "$BACKUP_MOUNT"
confirm 'Confirm that this is a valid full-system backup. Update indexes and download these Alpha packages?'
if [ "$FORMAT" = ipk ]; then opkg update; else apk update; fi
WORK=$(mktemp -d /tmp/quickstart-1113-0.17.1-rc20261028-r2.XXXXXX)
printf 'Keeping downloaded files and logs in %s\n' "$WORK"
cd "$WORK"
for FILE in "$QS_FILE" "$NP_FILE" "$UI_FILE"; do
    curl --fail --location --silent --show-error --proto '=https' --proto-redir '=https' \
        --connect-timeout 20 --max-time 300 "$DOWNLOAD_URL/$FILE" --output "$FILE"
    [ -s "$FILE" ] || fail "Empty download: $FILE"
done
printf '%s  %s\n%s  %s\n%s  %s\n' \
    "$QS_SHA" "$QS_FILE" "$NP_SHA" "$NP_FILE" "$UI_SHA" "$UI_FILE" >SHA256SUMS
sha256sum -c SHA256SUMS
ls -lh "$QS_FILE" "$NP_FILE" "$UI_FILE"
cat SHA256SUMS
df -h / /tmp
if [ "$FORMAT" = ipk ]; then
    if opkg --noaction install "./$QS_FILE" "./$NP_FILE" "./$UI_FILE" >preflight.log 2>&1; then
        cat preflight.log
    else cat preflight.log; fail 'Dependency/architecture preflight failed'; fi
else
    if apk add --simulate --allow-untrusted "./$QS_FILE" "./$NP_FILE" "./$UI_FILE" >preflight.log 2>&1; then
        cat preflight.log
    else cat preflight.log; fail 'Dependency/architecture preflight failed'; fi
fi
confirm 'SHA256 and dependency preflight passed. Install backend/netpolicy, then LuCI?'
if [ "$FORMAT" = ipk ]; then
    opkg install "./$QS_FILE" "./$NP_FILE" >install-runtime.log 2>&1 || {
        cat install-runtime.log; fail 'Runtime installation failed; LuCI was not installed'; }
    cat install-runtime.log
    opkg install "./$UI_FILE" >install-luci.log 2>&1 || {
        cat install-luci.log; fail 'LuCI installation failed'; }
else
    apk add --allow-untrusted "./$QS_FILE" "./$NP_FILE" >install-runtime.log 2>&1 || {
        cat install-runtime.log; fail 'Runtime installation failed; LuCI was not installed'; }
    cat install-runtime.log
    apk add --allow-untrusted "./$UI_FILE" >install-luci.log 2>&1 || {
        cat install-luci.log; fail 'LuCI installation failed'; }
fi
cat install-luci.log
check_version() {
    PACKAGE=$1 EXPECTED=$2
    if [ "$FORMAT" = ipk ]; then
        ACTUAL=$(opkg status "$PACKAGE" | awk '/^Version: / {print $2}')
        opkg status "$PACKAGE" | grep -q '^Status: .* installed$' || fail "$PACKAGE is not installed"
        [ "$ACTUAL" = "$EXPECTED" ] || fail "$PACKAGE version mismatch: $ACTUAL, expected $EXPECTED"
    else
        apk info -e "$PACKAGE=$EXPECTED" >/dev/null ||
            fail "$PACKAGE version mismatch: expected $EXPECTED"
    fi
    printf 'Verified installed: %s %s\n' "$PACKAGE" "$EXPECTED"
}
check_version quickstart "$QS_VERSION"
check_version quickstart-netpolicy "$NP_VERSION"
check_version luci-app-quickstart "$UI_VERSION"
quickstart version
if [ -x /etc/init.d/quickstart ]; then /etc/init.d/quickstart status; fi
printf 'Package installation verified. Verify authenticated homepage and /lanctrl/v2/devices/ before accepting business functionality.\n'