#!/usr/bin/env bash
set -euo pipefail

GO_REQUIRED="${GO_REQUIRED:-1.21.13}"
BUN_REQUIRED="${BUN_REQUIRED:-1.1.45}"
NODE_REQUIRED="${NODE_REQUIRED:-20.19.0}"
PNPM_REQUIRED="${PNPM_REQUIRED:-9.15.9}"
TOOLCHAIN_DIR="${TOOLCHAIN_DIR:-$ROOT_DIR/.toolchain}"
VERIFY_TOOLCHAIN_CHECKSUMS="${VERIFY_TOOLCHAIN_CHECKSUMS:-false}"
GO_ARCHIVE_SHA256="${GO_ARCHIVE_SHA256:-}"
NODE_ARCHIVE_SHA256="${NODE_ARCHIVE_SHA256:-}"
BUN_ARCHIVE_SHA256="${BUN_ARCHIVE_SHA256:-}"

verify_archive_sha256() {
  local archive="$1"
  local expected="$2"
  local label="$3"

  if [ "$VERIFY_TOOLCHAIN_CHECKSUMS" != "true" ]; then
    return 0
  fi

  [ -n "$expected" ] || fail "missing expected SHA256 for $label (set ${label}_SHA256 env)"
  local actual
  actual="$(sha256sum "$archive" | awk '{print $1}')"
  [ "$actual" = "$expected" ] || fail "$label sha256 mismatch: expected $expected, got $actual"
}

require_linux_debian13_amd64() {
  [ "$(uname -s)" = "Linux" ] || fail "production builder supports only Linux Debian 13 amd64"

  local arch
  arch="$(uname -m)"
  [ "$arch" = "x86_64" ] || [ "$arch" = "amd64" ] || fail "production builder supports only amd64, got: $arch"

  [ -f /etc/os-release ] || fail "missing /etc/os-release"
  # shellcheck disable=SC1091
  . /etc/os-release
  [ "${ID:-}" = "debian" ] || fail "production builder supports only Debian 13, got: ${ID:-unknown}"
  [ "${VERSION_ID:-}" = "13" ] || fail "production builder supports only Debian 13, got version: ${VERSION_ID:-unknown}"
}

apt_install_missing() {
  local missing=()
  local pkg
  for pkg in "$@"; do
    if ! dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -q 'install ok installed'; then
      missing+=("$pkg")
    fi
  done

  if [ "${#missing[@]}" -eq 0 ]; then
    return 0
  fi

  log_info "Installing missing build packages: ${missing[*]}"
  if [ "$(id -u)" = "0" ]; then
    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${missing[@]}"
  elif command -v sudo >/dev/null 2>&1; then
    sudo apt-get update
    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${missing[@]}"
  else
    fail "missing packages (${missing[*]}) and neither root nor sudo is available"
  fi
}

ensure_build_dependencies() {
  apt_install_missing \
    ca-certificates curl unzip tar xz-utils git build-essential pkg-config \
    bash coreutils findutils grep sed gawk openssl

  require_tool curl
  require_tool tar
  require_tool xz
  require_tool unzip
  require_tool sha256sum
  require_tool find
  require_tool install
  require_tool sort
  require_tool xargs
  require_tool grep
  require_tool sed
}

go_version() {
  "$1" version | sed -E 's/^go version go([0-9.]+).*/\1/'
}

ensure_go() {
  local managed="$TOOLCHAIN_DIR/go/bin/go"
  local go_mode=""
  if [ -x "$managed" ] && [ "$(go_version "$managed")" = "$GO_REQUIRED" ]; then
    GO_BIN="$managed"
    go_mode="managed"
  elif command -v go >/dev/null 2>&1 && [ "$(go_version "$(command -v go)")" = "$GO_REQUIRED" ]; then
    GO_BIN="$(command -v go)"
    go_mode="global"
  else
    log_info "Installing Go $GO_REQUIRED into $TOOLCHAIN_DIR/go"
    mkdir -p "$TOOLCHAIN_DIR/downloads"
    local archive="$TOOLCHAIN_DIR/downloads/go${GO_REQUIRED}.linux-amd64.tar.gz"
    download_file "https://go.dev/dl/go${GO_REQUIRED}.linux-amd64.tar.gz" "$archive"
    verify_archive_sha256 "$archive" "$GO_ARCHIVE_SHA256" "GO_ARCHIVE"
    rm -rf "$TOOLCHAIN_DIR/go"
    tar -C "$TOOLCHAIN_DIR" -xzf "$archive"
    GO_BIN="$managed"
    go_mode="managed"
  fi

  export GO_BIN
  if [ "$go_mode" = "managed" ]; then
    export GOROOT="$TOOLCHAIN_DIR/go"
  else
    unset GOROOT || true
  fi
  export PATH="$(dirname "$GO_BIN"):$PATH"
  export GOTOOLCHAIN=local
  [ "$(go_version "$GO_BIN")" = "$GO_REQUIRED" ] || fail "Go version mismatch: required $GO_REQUIRED, got $($GO_BIN version)"
}

ensure_bun() {
  local managed="$TOOLCHAIN_DIR/bun/bin/bun"
  if [ -x "$managed" ] && [ "$($managed --version)" = "$BUN_REQUIRED" ]; then
    BUN_BIN="$managed"
  elif command -v bun >/dev/null 2>&1 && [ "$(bun --version)" = "$BUN_REQUIRED" ]; then
    BUN_BIN="$(command -v bun)"
  else
    log_info "Installing Bun $BUN_REQUIRED into $TOOLCHAIN_DIR/bun"
    mkdir -p "$TOOLCHAIN_DIR/downloads" "$TOOLCHAIN_DIR/bun"
    local archive="$TOOLCHAIN_DIR/downloads/bun-linux-x64-${BUN_REQUIRED}.zip"
    download_file "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_REQUIRED}/bun-linux-x64.zip" "$archive"
    verify_archive_sha256 "$archive" "$BUN_ARCHIVE_SHA256" "BUN_ARCHIVE"
    rm -rf "$TOOLCHAIN_DIR/bun-tmp" "$TOOLCHAIN_DIR/bun"
    mkdir -p "$TOOLCHAIN_DIR/bun-tmp"
    unzip -q "$archive" -d "$TOOLCHAIN_DIR/bun-tmp"
    mkdir -p "$TOOLCHAIN_DIR/bun/bin"
    install -m 0755 "$TOOLCHAIN_DIR/bun-tmp/bun-linux-x64/bun" "$managed"
    rm -rf "$TOOLCHAIN_DIR/bun-tmp"
    BUN_BIN="$managed"
  fi

  export BUN_BIN
  export PATH="$(dirname "$BUN_BIN"):$PATH"
  [ "$($BUN_BIN --version)" = "$BUN_REQUIRED" ] || fail "Bun version mismatch: required $BUN_REQUIRED, got $($BUN_BIN --version)"
}

node_version() {
  "$1" --version | sed 's/^v//'
}

ensure_node() {
  local managed="$TOOLCHAIN_DIR/node/bin/node"
  if [ -x "$managed" ] && [ "$(node_version "$managed")" = "$NODE_REQUIRED" ]; then
    NODE_BIN="$managed"
  elif command -v node >/dev/null 2>&1 && [ "$(node_version "$(command -v node)")" = "$NODE_REQUIRED" ]; then
    NODE_BIN="$(command -v node)"
  else
    log_info "Installing Node.js $NODE_REQUIRED into $TOOLCHAIN_DIR/node"
    mkdir -p "$TOOLCHAIN_DIR/downloads"
    local archive="$TOOLCHAIN_DIR/downloads/node-v${NODE_REQUIRED}-linux-x64.tar.xz"
    download_file "https://nodejs.org/dist/v${NODE_REQUIRED}/node-v${NODE_REQUIRED}-linux-x64.tar.xz" "$archive"
    verify_archive_sha256 "$archive" "$NODE_ARCHIVE_SHA256" "NODE_ARCHIVE"
    rm -rf "$TOOLCHAIN_DIR/node" "$TOOLCHAIN_DIR/node-v${NODE_REQUIRED}-linux-x64"
    tar -C "$TOOLCHAIN_DIR" -xJf "$archive"
    mv "$TOOLCHAIN_DIR/node-v${NODE_REQUIRED}-linux-x64" "$TOOLCHAIN_DIR/node"
    NODE_BIN="$managed"
  fi

  export NODE_BIN
  export PATH="$(dirname "$NODE_BIN"):$PATH"
  [ "$(node_version "$NODE_BIN")" = "$NODE_REQUIRED" ] || fail "Node.js version mismatch: required $NODE_REQUIRED, got $($NODE_BIN --version)"
}

ensure_pnpm() {
  local managed="$TOOLCHAIN_DIR/pnpm/bin/pnpm"
  export PATH="$TOOLCHAIN_DIR/pnpm/bin:$PATH"
  if [ -x "$managed" ] && [ "$($managed --version)" = "$PNPM_REQUIRED" ]; then
    PNPM_BIN="$managed"
  else
    log_info "Installing pnpm $PNPM_REQUIRED into $TOOLCHAIN_DIR/pnpm"
    mkdir -p "$TOOLCHAIN_DIR/pnpm/bin"
    corepack enable --install-directory "$TOOLCHAIN_DIR/pnpm/bin"
    corepack prepare "pnpm@$PNPM_REQUIRED" --activate
    [ -x "$managed" ] || fail "pnpm binary was not installed into $managed"
    PNPM_BIN="$managed"
  fi

  export PNPM_BIN
  [ "$($PNPM_BIN --version)" = "$PNPM_REQUIRED" ] || fail "pnpm version mismatch: required $PNPM_REQUIRED, got $($PNPM_BIN --version)"
}

ensure_toolchain() {
  ensure_go
  ensure_bun
  ensure_node
  ensure_pnpm

  log_info "Go: $($GO_BIN version)"
  log_info "Bun: $($BUN_BIN --version)"
  log_info "Node.js: $($NODE_BIN --version)"
  log_info "pnpm: $($PNPM_BIN --version)"
}