#!/bin/sh
set -eu

fail() {
  printf 'Private Keeper APT source: %s\n' "$1" >&2
  exit 1
}

source_directory='/etc/apt/sources.list.d'
source_file='/etc/apt/sources.list.d/private-keeper.list'
template_file='/usr/share/private-keeper/apt/private-keeper.list'
stable_record='deb [arch=amd64 signed-by=/usr/share/keyrings/private-keeper-archive-keyring.gpg check-valid-until=yes valid-until-max=172800] https://pk.community/apt/ stable main'
beta_record='deb [arch=amd64 signed-by=/usr/share/keyrings/private-keeper-archive-keyring.gpg check-valid-until=yes valid-until-max=172800] https://pk.community/apt/ beta main'
alpha_record='deb [arch=amd64 signed-by=/usr/share/keyrings/private-keeper-archive-keyring.gpg check-valid-until=yes valid-until-max=172800] https://pk.community/apt/ alpha main'

read_channel() {
  target="$1"
  [ -f "$target" ] && [ ! -L "$target" ] || \
    fail "expected a regular source file at $target"
  metadata="$(stat -c '%u:%g:%a' -- "$target")" || \
    fail "cannot inspect $target"
  [ "$metadata" = '0:0:644' ] || \
    fail "$target must be owned by root:root with mode 0644"

  {
    if ! IFS= read -r line1 ||
       ! IFS= read -r line2 ||
       ! IFS= read -r line3; then
      fail "$target must contain exactly three complete records"
    fi
    if IFS= read -r extra; then
      fail "$target contains an extra record"
    fi
  } < "$target"

  if [ "$line1" = "$stable_record" ] &&
     [ "$line2" = "# $beta_record" ] &&
     [ "$line3" = "# $alpha_record" ]; then
    printf '%s\n' stable
  elif [ "$line1" = "# $stable_record" ] &&
       [ "$line2" = "$beta_record" ] &&
       [ "$line3" = "# $alpha_record" ]; then
    printf '%s\n' beta
  elif [ "$line1" = "# $stable_record" ] &&
       [ "$line2" = "# $beta_record" ] &&
       [ "$line3" = "$alpha_record" ]; then
    printf '%s\n' alpha
  else
    fail "$target is not one of the three package-owned channel states"
  fi
}

ensure_source() {
  [ -d "$source_directory" ] && [ ! -L "$source_directory" ] || \
    fail "$source_directory is not a regular directory"
  if [ -e "$source_file" ] || [ -L "$source_file" ]; then
    read_channel "$source_file" >/dev/null
    return
  fi

  [ "$(read_channel "$template_file")" = stable ] || \
    fail 'the packaged source template is not the Stable default'
  temporary="$(mktemp "$source_directory/.private-keeper.list.install.XXXXXX")" || \
    fail 'cannot allocate a temporary source file'
  cleanup_temporary() {
    if [ -n "${temporary-}" ] && [ -f "$temporary" ]; then
      rm -f -- "$temporary"
    fi
  }
  trap cleanup_temporary 0 1 2 15
  install -o root -g root -m 0644 -- "$template_file" "$temporary"
  ln -- "$temporary" "$source_file" || \
    fail "$source_file appeared while the package was being configured"
  rm -f -- "$temporary"
  temporary=''
}

remove_source() {
  if [ ! -e "$source_file" ] && [ ! -L "$source_file" ]; then
    return
  fi
  read_channel "$source_file" >/dev/null
  rm -f -- "$source_file"
}

[ "$#" -eq 1 ] || fail 'expected exactly one lifecycle operation'
case "$1" in
  ensure) ensure_source ;;
  remove) remove_source ;;
  *) fail 'unsupported lifecycle operation' ;;
esac
