#!/usr/bin/env bash
# name: op
# summary: Install the 1Password CLI
#
#   curl -fsSL https://install.xaritomi.xyz/op | sudo bash
#
# Installs from 1Password's signed apt repository on Debian/Ubuntu, falling back
# to the standalone binary elsewhere. Does NOT sign you in - see `op --help`, or
# set OP_SERVICE_ACCOUNT_TOKEN for unattended use.
#
# Note: `op` reads stdin as a JSON template, so when scripting it always pass
# `</dev/null` - otherwise it fails with "invalid JSON in piped input".
set -euo pipefail

OP_FALLBACK_VERSION="${OP_FALLBACK_VERSION:-2.31.1}"

log()  { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
die()  { printf '\033[1;31merror:\033[0m %s\n' "$*" >&2; exit 1; }

require_root() { [ "$(id -u)" -eq 0 ] || die "must run as root (pipe to 'sudo bash')"; }

arch() {
  case "$(uname -m)" in
    x86_64|amd64) echo amd64 ;;
    aarch64|arm64) echo arm64 ;;
    *) die "unsupported architecture: $(uname -m)" ;;
  esac
}

install_apt() {
  local a; a=$(arch)
  log "adding 1Password's apt repository"
  install -d -m 0755 /usr/share/keyrings
  curl -fsSL https://downloads.1password.com/linux/keys/1password.asc \
    | gpg --dearmor --yes -o /usr/share/keyrings/1password-archive-keyring.gpg
  printf 'deb [arch=%s signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/%s stable main\n' \
    "$a" "$a" > /etc/apt/sources.list.d/1password.list

  # debsig policy, so the package signature is actually checked
  install -d -m 0755 /etc/debsig/policies/AC2D62742012EA22/
  curl -fsSL https://downloads.1password.com/linux/debian/debsig/1password.pol \
    -o /etc/debsig/policies/AC2D62742012EA22/1password.pol
  install -d -m 0755 /usr/share/debsig/keyrings/AC2D62742012EA22
  curl -fsSL https://downloads.1password.com/linux/keys/1password.asc \
    | gpg --dearmor --yes -o /usr/share/debsig/keyrings/AC2D62742012EA22/debsig.gpg

  log "installing 1password-cli"
  DEBIAN_FRONTEND=noninteractive apt-get update -qq
  DEBIAN_FRONTEND=noninteractive apt-get install -y -qq 1password-cli
}

install_binary() {
  local a tmp; a=$(arch); tmp=$(mktemp -d)
  log "installing the standalone op binary v${OP_FALLBACK_VERSION}"
  command -v unzip >/dev/null 2>&1 || die "unzip is required for the fallback install"
  curl -fsSL -o "$tmp/op.zip" \
    "https://cache.agilebits.com/dist/1P/op2/pkg/v${OP_FALLBACK_VERSION}/op_linux_${a}_v${OP_FALLBACK_VERSION}.zip"
  unzip -oq "$tmp/op.zip" op -d /usr/local/bin
  chmod 0755 /usr/local/bin/op
  rm -rf "$tmp"
}

main() {
  case "${1:-}" in -h|--help) sed -n '2,/^set -euo/p' "$0" | sed 's/^# \{0,1\}//; /^set -euo/d'; exit 0 ;; esac
  require_root
  if command -v op >/dev/null 2>&1; then
    log "op already installed ($(op --version </dev/null 2>/dev/null || echo unknown))"
    exit 0
  fi
  command -v curl >/dev/null 2>&1 || die "curl is required"
  if command -v apt-get >/dev/null 2>&1 && command -v gpg >/dev/null 2>&1; then
    install_apt
  else
    install_binary
  fi
  command -v op >/dev/null 2>&1 || die "install finished but op is not on PATH"
  log "done: op $(op --version </dev/null 2>/dev/null || echo '?')"
  log "sign in with: eval \$(op signin)   # or set OP_SERVICE_ACCOUNT_TOKEN"
}

main "$@"