#!/usr/bin/env bash
# Extreme Endpoint Agent — Linux installer (defensive enroll only)
# EXTREME TECHNOLOGY — Extreme Cyber Security Test
#
# Usage:
#   curl -fsSL https://cs.extreme.ps/downloads/agents/linux/install.sh | bash -s -- --token ACS-...
#   ./install.sh --token "$ECS_ACTIVATION_TOKEN" --cloud-url https://cs.extreme.ps
#
# Env: ECS_ACTIVATION_TOKEN, EXTREME_CLOUD_URL
# Banned: any spyware / remote-shell flags are refused.

set -euo pipefail

AGENT_VERSION="1.0.0"
CHANNEL="stable"
CLOUD_URL="${EXTREME_CLOUD_URL:-https://cs.extreme.ps}"
TOKEN="${ECS_ACTIVATION_TOKEN:-}"
INSTALL_ROOT="${EXTREME_AGENT_HOME:-/opt/extreme-agent}"
LABEL="$(hostname -s 2>/dev/null || echo linux-host)"
LOCAL_STUB=0
SKIP_ENROLL=0
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

banner() {
  printf '\n  EXTREME TECHNOLOGY\n'
  printf '  Extreme Cyber Security Test — Endpoint Agent\n'
  printf '  Version %s (%s)\n' "$AGENT_VERSION" "$CHANNEL"
  printf '  Allowed: enroll · heartbeat · fingerprint only\n\n'
}

refuse_banned() {
  for a in "$@"; do
    case "$a" in
      *keylog*|*clipboard*|*screen*|*shell*|*exfil*|*rat*|*spy*)
        echo "Refused: installer does not support capability flag: $a" >&2
        exit 2
        ;;
    esac
  done
}

machine_id_hash() {
  local seed=""
  if [[ -r /etc/machine-id ]]; then
    seed="$(tr -d '[:space:]' </etc/machine-id)"
  elif [[ -r /var/lib/dbus/machine-id ]]; then
    seed="$(tr -d '[:space:]' </var/lib/dbus/machine-id)"
  else
    seed="$(hostname)-$(uname -m)-linux"
  fi
  if command -v sha256sum >/dev/null 2>&1; then
    printf 'extreme-machine-v1|%s' "$seed" | sha256sum | awk '{print $1}'
  elif command -v shasum >/dev/null 2>&1; then
    printf 'extreme-machine-v1|%s' "$seed" | shasum -a 256 | awk '{print $1}'
  else
    echo "sha256sum required" >&2
    exit 1
  fi
}

cloud_enroll() {
  local digest arch os_ver payload
  digest="$(machine_id_hash)"
  arch="$(uname -m)"
  os_ver="$(uname -r)"
  payload=$(cat <<JSON
{
  "protocolVersion": "1.0.0",
  "enrollmentToken": $(printf '%s' "$TOKEN" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))'),
  "deviceLabel": $(printf '%s' "$LABEL" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))'),
  "platform": "linux",
  "agentVersion": "$AGENT_VERSION",
  "capabilities": ["enroll", "heartbeat", "fingerprint.report"],
  "fingerprint": {
    "schemaVersion": 1,
    "collectedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "hostname": $(printf '%s' "$LABEL" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))'),
    "os": {"family": "linux", "name": "linux", "version": "$os_ver", "arch": "$arch"},
    "machineIdHash": "$digest",
    "agentVersion": "$AGENT_VERSION"
  }
}
JSON
)
  local tmp http_code
  tmp="$(mktemp)"
  http_code=$(curl -sS -o "$tmp" -w '%{http_code}' \
    -X POST "${CLOUD_URL%/}/api/v1/agents/enroll" \
    -H 'content-type: application/json' \
    -H 'accept: application/json' \
    -H 'x-extreme-agent-protocol: 1.0.0' \
    --data "$payload") || true
  if [[ "$http_code" != "200" ]]; then
    echo "Enroll failed (HTTP $http_code):" >&2
    cat "$tmp" >&2 || true
    rm -f "$tmp"
    exit 1
  fi
  mkdir -p "$INSTALL_ROOT/state"
  umask 077
  cp "$tmp" "$INSTALL_ROOT/state/enroll-response.json"
  python3 - "$tmp" "$INSTALL_ROOT/state/enrollment.json" "$CLOUD_URL" "$AGENT_VERSION" <<'PY'
import json, sys
src, dest, cloud, ver = sys.argv[1:5]
data = json.load(open(src))
if not data.get("ok"):
    raise SystemExit(json.dumps(data))
state = {
  "agentId": data["agentId"],
  "deviceId": data["deviceId"],
  "orgId": data.get("orgId"),
  "seatId": data.get("seatId"),
  "agentToken": data["agentToken"],
  "cloudUrl": cloud.rstrip("/"),
  "enrolledAt": __import__("datetime").datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ"),
  "agentVersion": ver,
}
json.dump(state, open(dest, "w"), indent=2)
print(f"Enrolled agentId={state['agentId']} deviceId={state['deviceId']}")
PY
  rm -f "$tmp"
  # Drop activation token after successful enroll
  rm -f "$INSTALL_ROOT/state/activation.token"
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --token) TOKEN="${2:-}"; shift 2 ;;
    --cloud-url) CLOUD_URL="${2:-}"; shift 2 ;;
    --install-root) INSTALL_ROOT="${2:-}"; shift 2 ;;
    --label) LABEL="${2:-}"; shift 2 ;;
    --local-stub) LOCAL_STUB=1; shift ;;
    --skip-enroll) SKIP_ENROLL=1; shift ;;
    -h|--help)
      grep '^#' "$0" | head -20
      exit 0
      ;;
    *)
      refuse_banned "$1"
      echo "Unknown arg: $1" >&2
      exit 1
      ;;
  esac
done

refuse_banned "$@"
banner

echo "[1/5] Creating $INSTALL_ROOT"
mkdir -p "$INSTALL_ROOT/bin" "$INSTALL_ROOT/state" "$INSTALL_ROOT/agent"

cat > "$INSTALL_ROOT/README.txt" <<EOF
Extreme Endpoint Agent (Linux)
Vendor: EXTREME TECHNOLOGY
Version: $AGENT_VERSION
Channel: $CHANNEL
Cloud: $CLOUD_URL

Allowed operations: enroll, heartbeat, fingerprint report.
No remote shell, keylogging, clipboard, or screen capture.
EOF

cat > "$INSTALL_ROOT/agent.json" <<EOF
{
  "product": "Extreme Endpoint Agent",
  "version": "$AGENT_VERSION",
  "channel": "$CHANNEL",
  "cloudUrl": "${CLOUD_URL%/}",
  "label": "$LABEL",
  "installedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "capabilities": ["enroll", "heartbeat", "fingerprint"],
  "banned": ["remote_shell", "keylogger", "clipboard_monitor", "screen_capture"]
}
EOF

echo "[2/5] Wrote $INSTALL_ROOT/agent.json"

# Prefer bundled agent package next to installer; else download versioned tarball.
if [[ -d "$SCRIPT_DIR/agent/dist" ]]; then
  echo "[3/5] Installing bundled agent CLI"
  cp -a "$SCRIPT_DIR/agent/." "$INSTALL_ROOT/agent/"
elif [[ -d "$SCRIPT_DIR/../agent/dist" ]]; then
  echo "[3/5] Installing sibling agent CLI"
  cp -a "$SCRIPT_DIR/../agent/." "$INSTALL_ROOT/agent/"
else
  PKG_URL="${CLOUD_URL%/}/downloads/agents/packages/ExtremeAgent-${AGENT_VERSION}-linux.tar.gz"
  echo "[3/5] Fetching $PKG_URL"
  TMPPKG="$(mktemp -d)"
  if curl -fsSL "$PKG_URL" -o "$TMPPKG/agent.tgz"; then
    tar -xzf "$TMPPKG/agent.tgz" -C "$TMPPKG"
    for cand in \
      "$TMPPKG/agent" \
      "$TMPPKG/ExtremeAgent/agent" \
      "$TMPPKG/ExtremeAgent-linux/agent" \
      "$TMPPKG/ExtremeAgent-macos/agent"
    do
      if [[ -d "$cand/dist" ]]; then
        cp -a "$cand/." "$INSTALL_ROOT/agent/"
        break
      fi
    done
  else
    echo "      Package download skipped (offline or missing); curl enroll still works."
  fi
  rm -rf "$TMPPKG"
fi

cat > "$INSTALL_ROOT/bin/extreme-agent" <<EOF
#!/usr/bin/env bash
set -euo pipefail
ROOT="$INSTALL_ROOT"
export EXTREME_CLOUD_URL="\${EXTREME_CLOUD_URL:-$CLOUD_URL}"
if [[ -f "\$ROOT/agent/dist/index.js" ]] && command -v node >/dev/null 2>&1; then
  exec node "\$ROOT/agent/dist/index.js" --state-dir "\$ROOT/state" --base-url "\$EXTREME_CLOUD_URL" "\$@"
fi
echo "Node.js 20+ required for CLI heartbeat/fingerprint. Enrollment state is in \$ROOT/state." >&2
exit 1
EOF
chmod +x "$INSTALL_ROOT/bin/extreme-agent"

echo "[4/5] Layout ready"

if [[ "$SKIP_ENROLL" -eq 1 ]]; then
  echo "[5/5] Skipping enroll."
  exit 0
fi

if [[ "$LOCAL_STUB" -eq 1 ]]; then
  echo "[5/5] Local stub mode — run extreme-agent enroll --local-stub"
  exit 0
fi

if [[ -z "$TOKEN" ]]; then
  echo "No activation token. Set ECS_ACTIVATION_TOKEN or pass --token."
  echo "Create a token in the console: Subscribers → Licenses or /app/agents wizard."
  exit 0
fi

umask 077
printf '%s\n' "$TOKEN" > "$INSTALL_ROOT/state/activation.token"
echo "[5/5] Enrolling against ${CLOUD_URL%/}/api/v1/agents/enroll …"
cloud_enroll
echo "Install complete. CLI: $INSTALL_ROOT/bin/extreme-agent heartbeat"