#!/usr/bin/env bash
set -Eeuo pipefail
BASE_URL="${THEX_BASE_URL:-https://panel.thex.cam}"
TMP=$(mktemp -d /tmp/thex-v7.XXXXXX)
trap 'rm -rf "$TMP"' EXIT
[ "$(id -u)" -eq 0 ] || { echo '[THEX] Run as root.' >&2; exit 1; }
command -v curl >/dev/null || { echo '[THEX] curl is required.' >&2; exit 1; }
command -v sha256sum >/dev/null || { echo '[THEX] sha256sum is required.' >&2; exit 1; }
command -v python3 >/dev/null || { apt-get update && apt-get install -y python3; }

echo "[THEX] Reading $BASE_URL/release/manifest.json"
curl -fsSL --proto '=https' --tlsv1.2 "$BASE_URL/release/manifest.json" -o "$TMP/manifest.json"
python3 - "$TMP/manifest.json" <<'PY'
import json,sys
m=json.load(open(sys.argv[1]))
assert m.get('version','').startswith('7.')
assert m.get('php')=='7.4'
assert m.get('package')
assert m.get('sha256')
print('[THEX] manifest verified: v'+m['version']+' / PHP '+m['php'])
PY
VERSION=$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1]))["version"])' "$TMP/manifest.json")
PACKAGE=$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1]))["package"])' "$TMP/manifest.json")
EXPECTED=$(python3 -c 'import json,sys;print(json.load(open(sys.argv[1]))["sha256"])' "$TMP/manifest.json")
curl -fL --proto '=https' --tlsv1.2 "$BASE_URL/release/$PACKAGE" -o "$TMP/$PACKAGE"
ACTUAL=$(sha256sum "$TMP/$PACKAGE" | awk '{print $1}')
[ "$ACTUAL" = "$EXPECTED" ] || { echo '[THEX] SHA-256 mismatch.' >&2; exit 1; }
echo "[THEX] Downloaded and verified THEX $VERSION"
rm -rf /opt/thex-release
mkdir -p /opt/thex-release
tar -xzf "$TMP/$PACKAGE" -C /opt/thex-release
chmod +x /opt/thex-release/installer/*.sh
exec /opt/thex-release/installer/install.sh