#!/usr/bin/env bash
# Extreme Endpoint Agent — macOS installer (defensive enroll only)
# EXTREME TECHNOLOGY — Extreme Cyber Security Test
#
# Usage:
#   ./install.sh --token ACS-... --cloud-url https://cs.extreme.ps
#
# For signed .pkg / notarization workflow see NOTES-pkg.md.

set -euo pipefail

AGENT_VERSION="1.0.0"
CHANNEL="stable"
CLOUD_URL="${EXTREME_CLOUD_URL:-https://cs.extreme.ps}"
TOKEN="${ECS_ACTIVATION_TOKEN:-}"
INSTALL_ROOT="${EXTREME_AGENT_HOME:-$HOME/Library/Application Support/ExtremeCyber/agent}"
LABEL="$(scutil --get ComputerName 2>/dev/null || hostname -s)"
LOCAL_STUB=0
SKIP_ENROLL=0
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

banner() {
  printf '\n  EXTREME TECHNOLOGY\n'
  printf '  Extreme Cyber Security Test — Endpoint Agent (macOS)\n'
  printf '  Version %s (%s)\n' "$AGENT_VERSION" "$CHANNEL"
  printf '  Allowed: enroll · heartbeat · fingerprint only\n'
  printf '  TCC: no Accessibility / Input Monitoring / Screen Recording requests\n\n'
}

refuse_banned() {
  for a in "$@"; do
    case "$a" in
      *keylog*|*clipboard*|*screen*|*shell*|*exfil*|*rat*|*spy*)
        echo "Refused: installer does not support capability flag: $a" >&2
        exit 2
        ;;
    esac
  done
}

machine_id_hash() {
  local seed
  seed="$(ioreg -rd1 -c IOPlatformExpertDevice 2>/dev/null | awk -F'\"' '/IOPlatformUUID/{print $4; exit}')"
  if [[ -z "$seed" ]]; then
    seed="$(hostname)-$(uname -m)-macos"
  fi
  printf 'extreme-machine-v1|%s' "$seed" | shasum -a 256 | awk '{print $1}'
}

cloud_enroll() {
  local digest arch os_ver payload tmp http_code
  digest="$(machine_id_hash)"
  arch="$(uname -m)"
  os_ver="$(sw_vers -productVersion 2>/dev/null || uname -r)"
  payload=$(python3 - "$TOKEN" "$LABEL" "$AGENT_VERSION" "$digest" "$arch" "$os_ver" <<'PY'
import json, sys, datetime
token, label, ver, digest, arch, os_ver = sys.argv[1:7]
print(json.dumps({
  "protocolVersion": "1.0.0",
  "enrollmentToken": token,
  "deviceLabel": label,
  "platform": "macos",
  "agentVersion": ver,
  "capabilities": ["enroll", "heartbeat", "fingerprint.report"],
  "fingerprint": {
    "schemaVersion": 1,
    "collectedAt": datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ"),
    "hostname": label,
    "os": {"family": "macos", "name": "darwin", "version": os_ver, "arch": arch},
    "machineIdHash": digest,
    "agentVersion": ver,
  },
}))
PY
)
  tmp="$(mktemp)"
  http_code=$(curl -sS -o "$tmp" -w '%{http_code}' \
    -X POST "${CLOUD_URL%/}/api/v1/agents/enroll" \
    -H 'content-type: application/json' \
    -H 'accept: application/json' \
    -H 'x-extreme-agent-protocol: 1.0.0' \
    --data "$payload") || true
  if [[ "$http_code" != "200" ]]; then
    echo "Enroll failed (HTTP $http_code):" >&2
    cat "$tmp" >&2 || true
    rm -f "$tmp"
    exit 1
  fi
  mkdir -p "$INSTALL_ROOT/state"
  umask 077
  cp "$tmp" "$INSTALL_ROOT/state/enroll-response.json"
  python3 - "$tmp" "$INSTALL_ROOT/state/enrollment.json" "$CLOUD_URL" "$AGENT_VERSION" <<'PY'
import json, sys, datetime
src, dest, cloud, ver = sys.argv[1:5]
data = json.load(open(src))
if not data.get("ok"):
    raise SystemExit(json.dumps(data))
state = {
  "agentId": data["agentId"],
  "deviceId": data["deviceId"],
  "orgId": data.get("orgId"),
  "seatId": data.get("seatId"),
  "agentToken": data["agentToken"],
  "cloudUrl": cloud.rstrip("/"),
  "enrolledAt": datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ"),
  "agentVersion": ver,
}
json.dump(state, open(dest, "w"), indent=2)
print(f"Enrolled agentId={state['agentId']} deviceId={state['deviceId']}")
PY
  rm -f "$tmp" "$INSTALL_ROOT/state/activation.token"
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --token) TOKEN="${2:-}"; shift 2 ;;
    --cloud-url) CLOUD_URL="${2:-}"; shift 2 ;;
    --install-root) INSTALL_ROOT="${2:-}"; shift 2 ;;
    --label) LABEL="${2:-}"; shift 2 ;;
    --local-stub) LOCAL_STUB=1; shift ;;
    --skip-enroll) SKIP_ENROLL=1; shift ;;
    -h|--help) grep '^#' "$0" | head -18; exit 0 ;;
    *) refuse_banned "$1"; echo "Unknown arg: $1" >&2; exit 1 ;;
  esac
done

refuse_banned "$@"
banner

echo "[1/5] Creating $INSTALL_ROOT"
mkdir -p "$INSTALL_ROOT/bin" "$INSTALL_ROOT/state" "$INSTALL_ROOT/agent"

cat > "$INSTALL_ROOT/README.txt" <<EOF
Extreme Endpoint Agent (macOS)
Vendor: EXTREME TECHNOLOGY
Version: $AGENT_VERSION
Channel: $CHANNEL
Cloud: $CLOUD_URL

This companion does not request Accessibility, Input Monitoring, or Screen Recording.
Enrollment uses an org activation token and reports hashed inventory only.
EOF

cat > "$INSTALL_ROOT/agent.json" <<EOF
{
  "product": "Extreme Endpoint Agent",
  "version": "$AGENT_VERSION",
  "channel": "$CHANNEL",
  "cloudUrl": "${CLOUD_URL%/}",
  "label": "$LABEL",
  "platform": "macos",
  "installedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "capabilities": ["enroll", "heartbeat", "fingerprint"],
  "banned": ["remote_shell", "keylogger", "clipboard_monitor", "screen_capture"]
}
EOF

echo "[2/5] Wrote agent.json"

if [[ -d "$SCRIPT_DIR/agent/dist" ]]; then
  echo "[3/5] Installing bundled agent CLI"
  cp -a "$SCRIPT_DIR/agent/." "$INSTALL_ROOT/agent/"
elif [[ -d "$SCRIPT_DIR/../agent/dist" ]]; then
  echo "[3/5] Installing sibling agent CLI"
  cp -a "$SCRIPT_DIR/../agent/." "$INSTALL_ROOT/agent/"
else
  PKG_URL="${CLOUD_URL%/}/downloads/agents/packages/ExtremeAgent-${AGENT_VERSION}-macos.tar.gz"
  echo "[3/5] Fetching $PKG_URL"
  TMPPKG="$(mktemp -d)"
  if curl -fsSL "$PKG_URL" -o "$TMPPKG/agent.tgz"; then
    tar -xzf "$TMPPKG/agent.tgz" -C "$TMPPKG"
    for cand in \
      "$TMPPKG/agent" \
      "$TMPPKG/ExtremeAgent/agent" \
      "$TMPPKG/ExtremeAgent-linux/agent" \
      "$TMPPKG/ExtremeAgent-macos/agent"
    do
      if [[ -d "$cand/dist" ]]; then
        cp -a "$cand/." "$INSTALL_ROOT/agent/"
        break
      fi
    done
  else
    echo "      Package download skipped; curl enroll still works."
  fi
  rm -rf "$TMPPKG"
fi

cat > "$INSTALL_ROOT/bin/extreme-agent" <<EOF
#!/usr/bin/env bash
set -euo pipefail
ROOT="$INSTALL_ROOT"
export EXTREME_CLOUD_URL="\${EXTREME_CLOUD_URL:-$CLOUD_URL}"
if [[ -f "\$ROOT/agent/dist/index.js" ]] && command -v node >/dev/null 2>&1; then
  exec node "\$ROOT/agent/dist/index.js" --state-dir "\$ROOT/state" --base-url "\$EXTREME_CLOUD_URL" "\$@"
fi
echo "Node.js 20+ required for CLI heartbeat/fingerprint." >&2
exit 1
EOF
chmod +x "$INSTALL_ROOT/bin/extreme-agent"

echo "[4/5] Layout ready (LaunchAgent packaging: NOTES-pkg.md)"

if [[ "$SKIP_ENROLL" -eq 1 ]]; then
  echo "[5/5] Skipping enroll."
  exit 0
fi

if [[ "$LOCAL_STUB" -eq 1 ]]; then
  echo "[5/5] Local stub — use extreme-agent enroll --local-stub"
  exit 0
fi

if [[ -z "$TOKEN" ]]; then
  echo "No token. Pass --token or set ECS_ACTIVATION_TOKEN."
  exit 0
fi

umask 077
printf '%s\n' "$TOKEN" > "$INSTALL_ROOT/state/activation.token"
echo "[5/5] Enrolling against ${CLOUD_URL%/}/api/v1/agents/enroll …"
cloud_enroll
echo "Install complete."