#!/bin/bash
set -euo pipefail

version="1.4.9"
download_base="https://rustdesk.bosner.de/downloads"
id_server="rustdesk.bosner.de"
relay_server="rustdesk.bosner.de"
api_server="https://rustdesk.bosner.de"
public_key="2V5DxRrXp4mTyUqlmpRF2DRcOivfL2GcSLViXHXVJUg="
direct_access_port="21118"
config="host=${id_server},relay=${relay_server},api=${api_server},key=${public_key}"
app_path="/Applications/RustDesk.app"
binary_path="${app_path}/Contents/MacOS/RustDesk"

if [[ "$(id -u)" -ne 0 ]]; then
    echo "Administratorrechte werden benoetigt."
    exec sudo "$0" "$@"
fi

case "$(uname -m)" in
    arm64)
        architecture="aarch64"
        expected_sha256="f7935597b247d42c8f2a2ed71176a9f5868018cd9e1a33b8096418a668c8caf0"
        ;;
    x86_64)
        architecture="x86_64"
        expected_sha256="fa1129a0635019f9c5841937942cc2b08be028a192f47c009edde7e53812904e"
        ;;
    *)
        echo "Nicht unterstuetzte Architektur: $(uname -m)" >&2
        exit 1
        ;;
esac

temporary_directory="$(mktemp -d /tmp/rustdesk-bosner.XXXXXX)"
mount_point="${temporary_directory}/mount"
dmg_path="${temporary_directory}/rustdesk-${version}-${architecture}.dmg"
mounted=0

cleanup() {
    if [[ "$mounted" -eq 1 ]]; then
        hdiutil detach "$mount_point" -quiet || true
    fi
    rm -rf "$temporary_directory"
}
trap cleanup EXIT

mkdir -p "$mount_point"
echo "Lade RustDesk ${version} (${architecture}) ..."
curl --fail --location --silent --show-error \
    "${download_base}/rustdesk-${version}-${architecture}.dmg" \
    --output "$dmg_path"

actual_sha256="$(shasum -a 256 "$dmg_path" | awk '{print $1}')"
if [[ "$actual_sha256" != "$expected_sha256" ]]; then
    echo "SHA-256-Pruefung fehlgeschlagen." >&2
    echo "Erwartet: $expected_sha256" >&2
    echo "Erhalten: $actual_sha256" >&2
    exit 1
fi

hdiutil attach "$dmg_path" -nobrowse -readonly -mountpoint "$mount_point" -quiet
mounted=1

if [[ ! -d "${mount_point}/RustDesk.app" ]]; then
    echo "RustDesk.app wurde im DMG nicht gefunden." >&2
    exit 1
fi

echo "Installiere RustDesk nach ${app_path} ..."
rm -rf "$app_path"
ditto "${mount_point}/RustDesk.app" "$app_path"

console_user="${SUDO_USER:-}"
if [[ -z "$console_user" || "$console_user" == "root" || "$console_user" == "loginwindow" ]]; then
    console_user="$(stat -f '%Su' /dev/console)"
fi
if [[ -n "$console_user" && "$console_user" != "root" && "$console_user" != "loginwindow" ]]; then
    console_uid="$(id -u "$console_user")"
    launchctl asuser "$console_uid" sudo -u "$console_user" open -a "$app_path"
    sleep 5
fi

echo "Setze ID- und Relay-Server ..."
"$binary_path" --config "$config"
"$binary_path" --option allow-websocket Y
"$binary_path" --option direct-server Y
"$binary_path" --option direct-access-port "$direct_access_port"

if [[ -n "$console_user" && "$console_user" != "root" && "$console_user" != "loginwindow" ]]; then
    console_group="$(id -gn "$console_user")"
    user_home="$(dscl . -read "/Users/${console_user}" NFSHomeDirectory | awk '{print $2}')"
    config_path="${user_home}/Library/Preferences/com.carriez.RustDesk/RustDesk2.toml"
    if [[ -f "$config_path" ]]; then
        chown "${console_user}:${console_group}" "$config_path"
        chmod 600 "$config_path"
    fi
fi

configured_server="$("$binary_path" --option custom-rendezvous-server | tail -n 1)"
configured_relay="$("$binary_path" --option relay-server | tail -n 1)"
configured_api="$("$binary_path" --option api-server | tail -n 1)"
configured_key="$("$binary_path" --option key | tail -n 1)"
configured_websocket="$("$binary_path" --option allow-websocket | tail -n 1)"
configured_direct_server="$("$binary_path" --option direct-server | tail -n 1)"
configured_direct_port="$("$binary_path" --option direct-access-port | tail -n 1)"
if [[ "$configured_server" != "$id_server" ||
      "$configured_relay" != "$relay_server" ||
      "$configured_api" != "$api_server" ||
      "$configured_key" != "$public_key" ||
      "$configured_websocket" != "Y" ||
      "$configured_direct_server" != "Y" ||
      "$configured_direct_port" != "$direct_access_port" ]]; then
    echo "Konfiguration konnte nicht verifiziert werden. ID-Server: '$configured_server'" >&2
    exit 1
fi

client_id="$("$binary_path" --get-id | tail -n 1)"
echo "Fertig. RustDesk-ID: ${client_id}"
echo "ID-Server: ${configured_server}"
echo "Relay-Server: ${configured_relay}"
echo "Management-API: ${configured_api}"
echo "Sicherer Kontotransport: WebSocket/TLS aktiv"
echo "LAN-Direktzugriff: TCP ${configured_direct_port}"
echo "macOS fragt beim ersten Einsatz nach Bedienungshilfen und Bildschirmaufnahme."