#!/bin/sh
# Dociąga klucz GPG repo APT (jeśli brak) i ustawia Signed-By w sources.
# Sourcuj: . /opt/nivato-logger/bin/apt-ensure-keyring
# albo uruchom: apt-ensure-keyring
#
# POSIX sh — postinst debiana to #!/bin/sh (dash); bez BASH_SOURCE / local.
# Uwaga: przy source NIE ustawiamy set -euo (zepsułoby wywołującego).

NIVATO_APT_KEYRING="${NIVATO_APT_KEYRING:-/usr/share/keyrings/nivato-logger.gpg}"
NIVATO_APT_SOURCES="${NIVATO_APT_SOURCES:-/etc/apt/sources.list.d/nivato-logger.sources}"
NIVATO_APT_KEY_URL="${NIVATO_APT_KEY_URL:-https://apt.nivato.app/nivato.gpg}"

nivato_fetch_apt_keyring() {
    mkdir -p "$(dirname "$NIVATO_APT_KEYRING")"
    if [ -s "$NIVATO_APT_KEYRING" ]; then
        return 0
    fi
    _nivato_apt_tmp=$(mktemp)
    if command -v curl >/dev/null 2>&1; then
        curl -fsSL --connect-timeout 15 --max-time 60 "$NIVATO_APT_KEY_URL" -o "$_nivato_apt_tmp"
    elif command -v wget >/dev/null 2>&1; then
        wget -q -O "$_nivato_apt_tmp" --timeout=60 "$NIVATO_APT_KEY_URL"
    else
        echo "Brak curl/wget — nie mogę pobrać klucza APT z $NIVATO_APT_KEY_URL" >&2
        rm -f "$_nivato_apt_tmp"
        unset _nivato_apt_tmp
        return 1
    fi
    if [ ! -s "$_nivato_apt_tmp" ]; then
        echo "Pobrany klucz APT jest pusty ($NIVATO_APT_KEY_URL)" >&2
        rm -f "$_nivato_apt_tmp"
        unset _nivato_apt_tmp
        return 1
    fi
    mv "$_nivato_apt_tmp" "$NIVATO_APT_KEYRING"
    unset _nivato_apt_tmp
    chmod 644 "$NIVATO_APT_KEYRING"
    echo "Zainstalowano klucz APT → $NIVATO_APT_KEYRING"
}

nivato_write_apt_sources_signed() {
    mkdir -p "$(dirname "$NIVATO_APT_SOURCES")"
    cat > "$NIVATO_APT_SOURCES" <<EOF
Types: deb
URIs: https://apt.nivato.app/
Suites: bookworm
Components: main
Architectures: arm64
Signed-By: $NIVATO_APT_KEYRING
EOF
    chmod 644 "$NIVATO_APT_SOURCES"
}

# Przełącz Trusted:yes → Signed-By albo dopisz Signed-By gdy brak obu.
nivato_ensure_apt_sources_signed() {
    if [ ! -s "$NIVATO_APT_KEYRING" ]; then
        return 1
    fi
    if [ ! -f "$NIVATO_APT_SOURCES" ]; then
        nivato_write_apt_sources_signed
        echo "Źródło APT utworzone (Signed-By)"
        return 0
    fi
    if grep -q '^Signed-By:' "$NIVATO_APT_SOURCES" 2>/dev/null \
        && ! grep -q '^Trusted: yes' "$NIVATO_APT_SOURCES" 2>/dev/null \
        && grep -q '^Suites: bookworm' "$NIVATO_APT_SOURCES" 2>/dev/null; then
        return 0
    fi
    # Stary suite / Trusted / brak Signed-By → przepisz na Signed-By
    nivato_write_apt_sources_signed
    echo "Źródło APT → suite bookworm + Signed-By $NIVATO_APT_KEYRING"
}

nivato_ensure_apt_keyring_and_sources() {
    nivato_fetch_apt_keyring
    nivato_ensure_apt_sources_signed
}

# Gdy uruchomiony jako skrypt (nie source) — $0 kończy się na apt-ensure-keyring.
# Przy source z postinst $0 to postinst / dpkg — nic nie odpalamy.
case "$0" in
    *apt-ensure-keyring)
        set -eu
        nivato_ensure_apt_keyring_and_sources
        ;;
esac
