#!/usr/bin/env bash
# Swapps VPN installer - Cloudflare WARP + Zero Trust enrollment (swappsco)
# Usage:  curl -fsSL https://get.swapps.dev | bash
set -euo pipefail
TEAM="swappsco"
SERVER="ubuntu@deploycloud.swapps.dev"

say(){ printf '\n==> %s\n' "$*"; }
err(){ printf '\n!! %s\n' "$*" >&2; }

OS="$(uname -s)"

install_mac(){
  if [ -d "/Applications/Cloudflare WARP.app" ]; then
    say "Cloudflare WARP is already installed."
    return
  fi
  say "Downloading Cloudflare WARP..."
  TMP="$(mktemp -d)"
  curl -fsSL -o "$TMP/warp.pkg" "https://downloads.cloudflareclient.com/v1/download/macos/ga"
  say "Installing WARP (you will be asked for your macOS password)..."
  sudo installer -pkg "$TMP/warp.pkg" -target /
  rm -rf "$TMP"
}

install_linux(){
  if command -v warp-cli >/dev/null 2>&1; then
    say "Cloudflare WARP is already installed."
    return
  fi
  if ! command -v apt-get >/dev/null 2>&1; then
    err "The automatic installer only supports Debian/Ubuntu. Install WARP manually: https://pkg.cloudflareclient.com"
    exit 1
  fi
  say "Adding the Cloudflare repo and installing WARP (sudo)..."
  curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor -o /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
  echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list >/dev/null
  sudo apt-get update -qq
  sudo apt-get install -y cloudflare-warp
}

wait_daemon(){
  say "Waiting for the WARP service..."
  for i in $(seq 1 40); do warp-cli --accept-tos status >/dev/null 2>&1 && return 0; sleep 1; done
  err "The WARP service did not respond. Open the Cloudflare WARP app once and retry."
  exit 1
}

enroll(){
  say "Enrolling this device into the '$TEAM' organization."
  say "A browser will open: sign in with Google @swapps.com in a NORMAL window (not incognito)."
  warp-cli --accept-tos registration delete >/dev/null 2>&1 || true
  warp-cli --accept-tos registration new "$TEAM"
  say "Connecting to the VPN..."
  warp-cli --accept-tos connect || true
  for i in $(seq 1 20); do warp-cli --accept-tos status 2>/dev/null | grep -q Connected && break; sleep 2; done
}

verify(){
  ORG="$(warp-cli --accept-tos registration organization 2>/dev/null | head -1 | tr -d '[:space:]')"
  if warp-cli --accept-tos status 2>/dev/null | grep -q Connected && [ "$ORG" = "$TEAM" ]; then
    printf '\n=============================================\n'
    printf '  DONE: WARP connected to the VPN (%s)\n' "$TEAM"
    printf '=============================================\n\n'
    printf 'Connect to the deploycloud server with:\n\n'
    printf '    ssh %s\n\n' "$SERVER"
    printf '(Use your usual deploycloud key. If it is not your default key: ssh -i ~/.ssh/your-key %s)\n' "$SERVER"
  else
    err "Enrollment did not complete."
    err "Check:  warp-cli status   and   warp-cli registration organization  (should say $TEAM)"
    err "Make sure you completed the Google login in a NORMAL window (not incognito)."
    exit 1
  fi
}

say "Swapps VPN installer  (Cloudflare WARP -> $TEAM)"
case "$OS" in
  Darwin) install_mac ;;
  Linux)  install_linux ;;
  *) err "Operating system '$OS' is not supported by the automatic installer. Use the manual guide."; exit 1 ;;
esac
wait_daemon
enroll
verify