#!/bin/sh
#
# alexandr bootstrap — https://get.alexandr.so
#
# This script does exactly one thing: make sure Node.js 18+ is present, then hand
# off to the real installer, `npx alexandr@latest up`. Everything that matters —
# sign-in, Docker, the runtime image — happens in the CLI afterwards, gated by
# your alexandr account. No secrets are read, written, or sent by this script.
#
#   curl -fsSL https://get.alexandr.so | sh
#   curl -fsSL https://get.alexandr.so | sh -s -- --domain your-domain.com
#
# Verify before running (recommended for any curl|sh):
#   curl -fsSL https://get.alexandr.so -o alexandr-install.sh
#   curl -fsSL https://get.alexandr.so/sha256        # the published SHA-256
#   sha256sum alexandr-install.sh                    # compare, read it, then:
#   sh alexandr-install.sh
#
# Automated Node install covers Debian/Ubuntu (apt) via the NodeSource repository,
# added explicitly below — no nested curl|sh. Anything else gets instructions and a
# clean exit; with Node 18+ already installed this script is a plain pass-through.

set -eu

NODE_MAJOR_MIN=18
NODESOURCE_CHANNEL="node_22.x" # current LTS line

say() { printf '%s\n' "$*"; }
fail() {
	printf 'alexandr: %s\n' "$*" >&2
	exit 1
}

# Node 18+ AND npx (distro nodejs packages often ship without npm/npx).
node_ok() {
	command -v node >/dev/null 2>&1 || return 1
	command -v npx >/dev/null 2>&1 || return 1
	major="$(node -p 'process.versions.node.split(".")[0]' 2>/dev/null)" || return 1
	[ "$major" -ge "$NODE_MAJOR_MIN" ] 2>/dev/null
}

as_root() {
	if [ "$(id -u)" = "0" ]; then
		"$@"
	elif command -v sudo >/dev/null 2>&1; then
		sudo "$@"
	else
		fail "installing Node.js needs root — re-run as root, or install Node.js $NODE_MAJOR_MIN+ yourself (https://nodejs.org) and run: npx alexandr@latest up"
	fi
}

install_node_apt() {
	say "Installing Node.js (NodeSource $NODESOURCE_CHANNEL)…"
	export DEBIAN_FRONTEND=noninteractive
	as_root apt-get update -qq
	as_root apt-get install -y -qq ca-certificates curl gnupg >/dev/null
	as_root mkdir -p /etc/apt/keyrings
	curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key |
		as_root gpg --dearmor --yes -o /etc/apt/keyrings/nodesource.gpg
	say "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/$NODESOURCE_CHANNEL nodistro main" |
		as_root tee /etc/apt/sources.list.d/nodesource.list >/dev/null
	as_root apt-get update -qq
	as_root apt-get install -y -qq nodejs >/dev/null
}

main() {
	if node_ok; then
		say "Node $(node -v) found."
	else
		case "$(uname -s)" in
		Linux)
			if command -v apt-get >/dev/null 2>&1; then
				install_node_apt
			else
				fail "no Node.js $NODE_MAJOR_MIN+ found and this isn't an apt-based distro — install Node.js $NODE_MAJOR_MIN+ (https://nodejs.org), then run: npx alexandr@latest up"
			fi
			;;
		Darwin)
			fail "no Node.js $NODE_MAJOR_MIN+ found — brew install node (or https://nodejs.org), then run: npx alexandr@latest up"
			;;
		*)
			fail "unsupported system $(uname -s) — install Node.js $NODE_MAJOR_MIN+ (https://nodejs.org), then run: npx alexandr@latest up"
			;;
		esac
		node_ok || fail "Node.js install finished but node/npx still aren't usable — install Node.js $NODE_MAJOR_MIN+ manually, then run: npx alexandr@latest up"
		say "Node $(node -v) installed."
	fi

	say ""
	say "Handing off to the alexandr installer…"
	# This script arrives on stdin (curl | sh), so the installer's first-run questions
	# would read the pipe, not your keyboard — give it the real terminal back.
	if (exec </dev/tty) 2>/dev/null; then
		exec npx --yes alexandr@latest up "$@" </dev/tty
	else
		exec npx --yes alexandr@latest up "$@"
	fi
}

# Everything above only DEFINES things; work starts here, on the script's last line.
# A truncated download can therefore never run half an installer.
main "$@"