#!/usr/bin/env bash
# SPDX-License-Identifier: LicenseRef-CMSD-1.0
# Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
#
# SecuBox-Deb :: secubox-toolbox-fetch-apk (#536)
#
# Pull the latest Android ToolBox APK (published as a GitHub release
# asset by build-android-apk.yml on android-v* tags) into the toolbox
# serve path, so GET /wg/toolbox.apk serves it locally (offline-capable
# sideload from the cabine). Best-effort : a failure leaves any existing
# APK in place ; the endpoint falls back to the public release redirect.
set -euo pipefail
readonly MODULE="secubox-toolbox-fetch-apk"

DEST_DIR="/var/lib/secubox/toolbox/android"
DEST="${DEST_DIR}/village3b-toolbox.apk"
RELEASE_URL="https://github.com/CyberMind-FR/secubox-deb/releases/latest/download/secubox-toolbox-android.apk"

log() { logger -t "$MODULE" -- "$*" 2>/dev/null || echo "[$MODULE] $*" >&2; }

install -d -m 0755 -o secubox-toolbox -g secubox-toolbox "$DEST_DIR" 2>/dev/null \
  || mkdir -p "$DEST_DIR"

TMP=$(mktemp --suffix=.apk)
trap 'rm -f "$TMP"' EXIT

if command -v wget >/dev/null 2>&1; then
    if wget -q --timeout=20 --tries=2 "$RELEASE_URL" -O "$TMP" && [ -s "$TMP" ]; then
        # Sanity : APK is a ZIP — must start with PK\x03\x04.
        if head -c 2 "$TMP" | grep -q "PK"; then
            install -m 0644 "$TMP" "$DEST"
            chown secubox-toolbox:secubox-toolbox "$DEST" 2>/dev/null || true
            log "fetched APK -> ${DEST} ($(stat -c%s "$DEST" 2>/dev/null) bytes)"
            exit 0
        else
            log "downloaded file is not an APK (no release asset yet?) — keeping existing"
        fi
    else
        log "fetch failed (no release yet / network) — /wg/toolbox.apk will redirect to the release"
    fi
else
    log "wget missing — cannot fetch APK"
fi
exit 0
