#!/usr/bin/env bash
# Install Monet: Design Review on Omarchy.            https://iammonet.com/omarchy
#
#   curl -fsSL https://iammonet.com/omarchy/install.sh | bash
#
# What it does, in the open:
#   1. Reads Monet's release feed for the current Omarchy bundle.
#   2. Downloads the bundle and checks it against Monet's release key with
#      minisign (installed with pacman if it is missing).
#   3. Runs the bundle's own install.sh: pacman installs the package and asks
#      for your password; the Monet icon lands in the top bar.
# Nothing here runs as root except pacman. Monet then keeps itself up to date.
set -euo pipefail

FEED="https://iammonet.com/api/desktop-update"
RELEASES="https://github.com/benwgarton/monet-releases/releases/download"
# The first Omarchy release, used until the feed lists an Omarchy bundle.
FALLBACK_TAG="v1.3.1"
FALLBACK_ASSET="Monet-Design-Review-1.3.1-omarchy.tar.gz"
# Monet's release key (minisign). Every Monet build on every platform checks
# its updates against this same key.
PUBKEY="RWSM9eR5bQhU2GAzN1kYBoTi3l5F4mCF0aVdGgTU7Hp1h48TTayYxMoc"

say() { printf '\n%s\n' "$*"; }
fail() { printf '\nMonet was not installed: %s\n' "$*" >&2; exit 1; }

[[ $EUID -ne 0 ]] || fail "run this as your normal user, not with sudo."
[[ "$(uname -m)" == "x86_64" ]] || fail "Monet for Omarchy is built for 64-bit Intel/AMD computers."
for tool in curl pacman python3 tar; do
  command -v "$tool" >/dev/null 2>&1 || fail "$tool was not found. This script is for Omarchy (Arch Linux)."
done
if ! command -v minisign >/dev/null 2>&1; then
  say "Installing minisign, which checks the download's signature (pacman will ask for your password)..."
  sudo pacman -S --needed --noconfirm minisign || fail "minisign could not be installed."
fi

work="$(mktemp -d)"
trap 'rm -rf "$work"' EXIT

say "Reading Monet's release feed..."
feed="$(curl -fsSL --max-time 20 "$FEED" 2>/dev/null || true)"
read -r version url signature <<<"$(python3 - "$feed" <<'PY'
import json, sys
try:
    feed = json.loads(sys.argv[1] or "{}")
    entry = feed.get("platforms", {}).get("linux-x86_64") or {}
    print(feed.get("version", ""), entry.get("url", ""), entry.get("signature", ""))
except Exception:
    print("", "", "")
PY
)"

if [[ -n $url && -n $signature ]]; then
  say "Downloading Monet $version..."
  curl -fL --progress-bar --max-time 900 -o "$work/monet.tar.gz" "$url" || fail "the download did not finish."
  printf '%s' "$signature" | base64 -d > "$work/monet.minisig" || fail "the feed's signature could not be read."
else
  say "The feed does not list an Omarchy bundle yet; using the first Omarchy release ($FALLBACK_TAG)..."
  base="$RELEASES/$FALLBACK_TAG/$FALLBACK_ASSET"
  curl -fL --progress-bar --max-time 900 -o "$work/monet.tar.gz" "$base" ||
    fail "the Omarchy build is not published yet. See https://iammonet.com/omarchy"
  curl -fsSL --max-time 60 "$base.sig" | base64 -d > "$work/monet.minisig" ||
    fail "the bundle's signature is missing from the release."
fi

say "Checking the signature..."
minisign -Vm "$work/monet.tar.gz" -P "$PUBKEY" -x "$work/monet.minisig" >/dev/null ||
  fail "the download does not match Monet's signature, so it was not installed."

say "Unpacking..."
tar -C "$work" -xzf "$work/monet.tar.gz"
folder="$(ls -d "$work"/Monet-Design-Review-*-omarchy 2>/dev/null | head -1)"
[[ -n $folder && -f $folder/install.sh ]] || fail "the bundle did not unpack the way Monet expects."

# The bundle's installer takes it from here: pacman, the bar plugin, monet doctor.
cd "$folder"
bash install.sh