#!/bin/bash
# Dociąga klucz GPG repo APT (jeśli brak) i ustawia Signed-By w sources.
# Sourcuj: . /opt/nivato-logger/bin/apt-ensure-keyring
# albo uruchom: apt-ensure-keyring
#
# Uwaga: przy source NIE ustawiamy set -euo (zepsułoby wywołującego).

NIVATO_APT_KEYRING="${NIVATO_APT_KEYRING:-/usr/share/keyrings/nivato-logger.gpg}"
NIVATO_APT_SOURCES="${NIVATO_APT_SOURCES:-/etc/apt/sources.list.d/nivato-logger.sources}"
NIVATO_APT_KEY_URL="${NIVATO_APT_KEY_URL:-https://apt.nivato.app/nivato.gpg}"

nivato_fetch_apt_keyring() {
    mkdir -p "$(dirname "$NIVATO_APT_KEYRING")"
    if [ -s "$NIVATO_APT_KEYRING" ]; then
        return 0
    fi
    local tmp
    tmp=$(mktemp)
    if command -v curl >/dev/null 2>&1; then
        curl -fsSL --connect-timeout 15 --max-time 60 "$NIVATO_APT_KEY_URL" -o "$tmp"
    elif command -v wget >/dev/null 2>&1; then
        wget -q -O "$tmp" --timeout=60 "$NIVATO_APT_KEY_URL"
    else
        echo "Brak curl/wget — nie mogę pobrać klucza APT z $NIVATO_APT_KEY_URL" >&2
        rm -f "$tmp"
        return 1
    fi
    if [ ! -s "$tmp" ]; then
        echo "Pobrany klucz APT jest pusty ($NIVATO_APT_KEY_URL)" >&2
        rm -f "$tmp"
        return 1
    fi
    mv "$tmp" "$NIVATO_APT_KEYRING"
    chmod 644 "$NIVATO_APT_KEYRING"
    echo "Zainstalowano klucz APT → $NIVATO_APT_KEYRING"
}

nivato_write_apt_sources_signed() {
    mkdir -p "$(dirname "$NIVATO_APT_SOURCES")"
    cat > "$NIVATO_APT_SOURCES" <<EOF
Types: deb
URIs: https://apt.nivato.app/
Suites: bookworm
Components: main
Architectures: arm64
Signed-By: $NIVATO_APT_KEYRING
EOF
    chmod 644 "$NIVATO_APT_SOURCES"
}

# Przełącz Trusted:yes → Signed-By albo dopisz Signed-By gdy brak obu.
nivato_ensure_apt_sources_signed() {
    if [ ! -s "$NIVATO_APT_KEYRING" ]; then
        return 1
    fi
    if [ ! -f "$NIVATO_APT_SOURCES" ]; then
        nivato_write_apt_sources_signed
        echo "Źródło APT utworzone (Signed-By)"
        return 0
    fi
    if grep -q '^Signed-By:' "$NIVATO_APT_SOURCES" 2>/dev/null \
        && ! grep -q '^Trusted: yes' "$NIVATO_APT_SOURCES" 2>/dev/null \
        && grep -q '^Suites: bookworm' "$NIVATO_APT_SOURCES" 2>/dev/null; then
        return 0
    fi
    # Stary suite / Trusted / brak Signed-By → przepisz na Signed-By
    nivato_write_apt_sources_signed
    echo "Źródło APT → suite bookworm + Signed-By $NIVATO_APT_KEYRING"
}

nivato_ensure_apt_keyring_and_sources() {
    nivato_fetch_apt_keyring
    nivato_ensure_apt_sources_signed
}

# Gdy uruchomiony jako skrypt (nie source)
if [ "${BASH_SOURCE[0]-}" = "${0:-}" ]; then
    set -euo pipefail
    nivato_ensure_apt_keyring_and_sources
fi
