#!/bin/sh
# Single-approval voice capture setup: installs the SiriPlus Remote Mic driver
# and the passwordless PacketLogger capture rule (plus the managed PacketLogger
# import) in ONE privileged run, so setup asks for the administrator password
# once instead of once per component. Each component script stays the owner of
# its own behavior; this wrapper only sequences them.
set -eu

DRIVER_INSTALLER=""
DRIVER=""
SUDOERS_SCRIPT=""
USER_NAME=""
HELPER_PATH=""
PACKETLOGGER_SOURCE=""
PREFLIGHT=0

fail_preflight() {
  echo "setup_voice_capture.sh: preflight failed: $1" >&2
  exit 66
}

require_readable_file() {
  [ -r "$1" ] || fail_preflight "missing readable file: $1"
}

require_executable_file() {
  [ -x "$1" ] || fail_preflight "missing executable file: $1"
}

require_directory() {
  [ -d "$1" ] || fail_preflight "missing directory: $1"
}

plist_value() {
  /usr/libexec/PlistBuddy -c "Print :$2" "$1"
}

validate_driver_bundle() {
  require_directory "$1"
  driver_info="$1/Contents/Info.plist"
  driver_binary="$1/Contents/MacOS/SiriPlusRemoteMic"
  require_readable_file "$driver_info"
  require_executable_file "$driver_binary"

  identity_version="$(plist_value "$driver_info" "SiriPlusDriverIdentityVersion" 2>/dev/null || true)"
  [ "$identity_version" = "content-v3" ] || fail_preflight "driver identity version is not content-v3: ${identity_version:-<missing>}"
  source_hash="$(plist_value "$driver_info" "SiriPlusDriverSourceSHA256" 2>/dev/null || true)"
  [ -n "$source_hash" ] || fail_preflight "driver source hash is missing"
  [ "$source_hash" != "development-source-hash" ] || fail_preflight "driver still has development source hash"
  codesign --verify "$1" >/dev/null 2>&1 || fail_preflight "driver code signature verification failed: $1"
}

validate_packetlogger_source() {
  case "$1" in
    /*/PacketLogger.app/Contents/Resources/packetlogger)
      ;;
    *)
      fail_preflight "unsupported PacketLogger source path: $1"
      ;;
  esac
  require_executable_file "$1"
  source_app="${1%/Contents/Resources/packetlogger}"
  require_directory "$source_app/Contents"
}

run_preflight() {
  if [ -n "$DRIVER_INSTALLER" ] || [ -n "$DRIVER" ]; then
    [ -n "$DRIVER_INSTALLER" ] || fail_preflight "--driver-installer is required with --driver"
    [ -n "$DRIVER" ] || fail_preflight "--driver is required with --driver-installer"
    require_readable_file "$DRIVER_INSTALLER"
    validate_driver_bundle "$DRIVER"
  fi

  if [ -n "$SUDOERS_SCRIPT" ] || [ -n "$USER_NAME" ] || [ -n "$HELPER_PATH" ]; then
    [ -n "$SUDOERS_SCRIPT" ] || fail_preflight "--sudoers-script is required with PacketLogger setup"
    [ -n "$USER_NAME" ] || fail_preflight "--user is required with PacketLogger setup"
    [ -n "$HELPER_PATH" ] || fail_preflight "--helper-path is required with PacketLogger setup"
    require_readable_file "$SUDOERS_SCRIPT"
    require_executable_file "$HELPER_PATH"
    /usr/bin/id -u "$USER_NAME" >/dev/null 2>&1 || fail_preflight "user does not exist: $USER_NAME"
  fi

  if [ -n "$PACKETLOGGER_SOURCE" ]; then
    validate_packetlogger_source "$PACKETLOGGER_SOURCE"
  fi

  echo "Voice capture setup preflight passed."
}

while [ $# -gt 0 ]; do
  case "$1" in
    --preflight) PREFLIGHT=1; shift ;;
    --driver-installer) DRIVER_INSTALLER="$2"; shift 2 ;;
    --driver) DRIVER="$2"; shift 2 ;;
    --sudoers-script) SUDOERS_SCRIPT="$2"; shift 2 ;;
    --user) USER_NAME="$2"; shift 2 ;;
    --helper-path) HELPER_PATH="$2"; shift 2 ;;
    --packetlogger-source) PACKETLOGGER_SOURCE="$2"; shift 2 ;;
    *) echo "setup_voice_capture.sh: unknown option: $1" >&2; exit 64 ;;
  esac
done

if [ "$PREFLIGHT" -eq 1 ]; then
  run_preflight
  exit 0
fi

if [ -n "$DRIVER_INSTALLER" ] && [ -n "$DRIVER" ]; then
  /bin/sh "$DRIVER_INSTALLER" "$DRIVER"
fi

if [ -n "$SUDOERS_SCRIPT" ] && [ -n "$USER_NAME" ] && [ -n "$HELPER_PATH" ]; then
  if [ -n "$PACKETLOGGER_SOURCE" ]; then
    /bin/sh "$SUDOERS_SCRIPT" install \
      --user "$USER_NAME" \
      --helper-path "$HELPER_PATH" \
      --packetlogger-source "$PACKETLOGGER_SOURCE"
  else
    /bin/sh "$SUDOERS_SCRIPT" install \
      --user "$USER_NAME" \
      --helper-path "$HELPER_PATH"
  fi
fi
