#!/bin/bash
#
# probo-agent macOS PKG postinstall script.
#
# Runs as root inside the macOS Installer.app sandbox after the
# payload has been laid down. Standard pkgbuild positional args:
#
#   $1 = full path to the component package
#   $2 = full path to the install location (selected target)
#   $3 = mountpoint of the destination volume
#   $4 = root directory ("/" for the target volume)
#
# We intentionally do not abort the install if enrollment fails:
# the binary is laid down regardless, and the operator can finish
# enrollment with `sudo probo-agent install ...` from Terminal.

set -u

LOG_FILE="/var/log/probo-agent-install.log"
BINARY="/usr/local/bin/probo-agent"
STATE_DIR="/var/lib/probo-agent"
CONF_FILE="/tmp/probo-agent.conf"

# Mirror everything to the install log. We keep stdout/stderr open
# too so failures still surface in macOS Installer.app's log pane.
mkdir -p "$(dirname "${LOG_FILE}")"
exec > >(tee -a "${LOG_FILE}") 2>&1

echo
echo "=== probo-agent postinstall $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
echo "pkg=$1 target=$2 mount=$3 root=$4"

if [ ! -x "${BINARY}" ]; then
    echo "error: expected binary not found at ${BINARY}"
    exit 1
fi

mkdir -p "${STATE_DIR}"
chown root:wheel "${STATE_DIR}"
chmod 0700 "${STATE_DIR}"

# An admin (or MDM) may stage /tmp/probo-agent.conf to drive an
# unattended enrollment. Recognized keys (shell-style):
#
#   PROBO_SERVER_URL=https://app.getprobo.com
#   PROBO_ENROLLMENT_TOKEN=<token>
#   PROBO_NO_AUTO_UPDATE=true
#
# We source the file in a subshell so a malformed line can never
# leak variables into our env, then validate the values we care
# about.
if [ -f "${CONF_FILE}" ]; then
    echo "Found ${CONF_FILE}, attempting unattended enrollment."

    eval "$(
        set -e
        # shellcheck source=/dev/null
        . "${CONF_FILE}"
        printf 'CONF_SERVER=%q\n'  "${PROBO_SERVER_URL:-}"
        printf 'CONF_TOKEN=%q\n'   "${PROBO_ENROLLMENT_TOKEN:-}"
        printf 'CONF_NOUPDATE=%q\n' "${PROBO_NO_AUTO_UPDATE:-}"
    )"

    if [ -z "${CONF_SERVER}" ] || [ -z "${CONF_TOKEN}" ]; then
        echo "warning: ${CONF_FILE} is missing PROBO_SERVER_URL or PROBO_ENROLLMENT_TOKEN; skipping enrollment."
    else
        EXTRA_FLAGS=()
        case "${CONF_NOUPDATE}" in
            1|true|TRUE|yes|YES) EXTRA_FLAGS+=("--no-auto-update") ;;
        esac

        if "${BINARY}" install \
                --server "${CONF_SERVER}" \
                --enrollment-token "${CONF_TOKEN}" \
                "${EXTRA_FLAGS[@]}"; then
            echo "Device enrolled and service installed."
        else
            echo "warning: probo-agent install failed; the binary is in place and can be re-run by an admin."
        fi
    fi

    # The token in the conf file is sensitive; clear it whatever
    # the outcome so a successful install does not leave secrets
    # in /tmp.
    rm -f "${CONF_FILE}"
else
    echo "No ${CONF_FILE} found; skipping automatic enrollment."
    echo "Finish setup with: sudo ${BINARY} install --server <URL> --enrollment-token <TOKEN>"
fi

echo "=== postinstall done ==="
exit 0