#!/bin/bash
# Velo 5G installer for macOS.
# Downloads the latest release from https://5g.velo-vpn.com, verifies its SHA-256, installs it into
# /Applications (or ~/Applications) and opens it. Files fetched by curl are not quarantined, so macOS
# shows no "Open Anyway" prompt. Read it first: https://5g.velo-vpn.com/install.sh
set -euo pipefail

BASE="${VELO_BASE:-https://5g.velo-vpn.com}"
APP="Velo 5G.app"
DEST_DIR="${VELO_DEST:-}"

say()  { printf '\033[1m%s\033[0m\n' "$*"; }
fail() { printf '\033[31mError: %s\033[0m\n' "$*" >&2; exit 1; }

[ "$(uname -s)" = "Darwin" ] || fail "Velo 5G is a macOS app."
command -v curl >/dev/null && command -v hdiutil >/dev/null && command -v shasum >/dev/null || fail "curl, hdiutil and shasum are required."

tmp="$(mktemp -d)"
cleanup() { hdiutil detach "$tmp/mnt" -quiet -force >/dev/null 2>&1 || true; rm -rf "$tmp"; }
trap cleanup EXIT

say "Checking the latest version..."
manifest="$(curl -fsSL "$BASE/latest.json?t=$(date +%s)")" || fail "Could not reach $BASE."
field() { printf '%s' "$manifest" | sed -n "s/.*\"$1\" *: *\"\([^\"]*\)\".*/\1/p"; }
version="$(field version)"; dmg="$(field dmg)"; sha="$(field sha256)"
[ -n "$version" ] && [ -n "$dmg" ] && [ -n "$sha" ] || fail "Unexpected response from the server."

say "Downloading Velo 5G $version..."
if [ -t 1 ]; then bar="--progress-bar"; else bar="-sS"; fi
curl -fL $bar -o "$tmp/$dmg" "$BASE/$dmg" </dev/null || fail "Download failed."

say "Verifying..."
[ "$(shasum -a 256 "$tmp/$dmg" | cut -d' ' -f1)" = "$sha" ] || fail "Checksum mismatch. Nothing was installed."

mkdir "$tmp/mnt"
hdiutil attach -nobrowse -readonly -noverify -mountpoint "$tmp/mnt" "$tmp/$dmg" >/dev/null </dev/null || fail "Could not open the disk image."
[ -d "$tmp/mnt/$APP" ] || fail "The disk image does not contain $APP."

if [ -z "$DEST_DIR" ]; then
  if [ -w /Applications ]; then DEST_DIR=/Applications; else DEST_DIR="$HOME/Applications"; fi
fi
mkdir -p "$DEST_DIR"

say "Installing into $DEST_DIR..."
# Close only the copy we are about to replace (never another Velo 5G the user may be using elsewhere).
if [ -d "$DEST_DIR/$APP" ] && pgrep -f "$DEST_DIR/$APP/Contents/MacOS" >/dev/null 2>&1; then
  say "Closing the running Velo 5G..."
  pkill -TERM -f "$DEST_DIR/$APP/Contents/MacOS" >/dev/null 2>&1 || true
  sleep 2
fi
rm -rf "$DEST_DIR/$APP"
ditto "$tmp/mnt/$APP" "$DEST_DIR/$APP"
xattr -dr com.apple.quarantine "$DEST_DIR/$APP" 2>/dev/null || true

say "Velo 5G $version is installed."
if [ -z "${VELO_NO_OPEN:-}" ]; then
  open "$DEST_DIR/$APP"
  echo "Connect your iPhone with a cable, unlock it, tap Trust, then press Turn on 5G."
fi