setupvenv

#!/usr/bin/env bash

# --- CONFIGURATION ---
TOOL_NAME="storm"
REPO_NAME="storm-framework"
GITHUB_REPO="https://github.com/StormWorld0/$REPO_NAME.git"

# Color
GREEN='\033[92m'
RED='\033[91m'
BLUE='\033[94m'
NC='\033[0m'

write_to_file() {
    local content=$1
    local file=$2
    local append=$3

    if [ "$append" = true ]; then
        echo "$content" | tee -a "$file" > /dev/null
    else
        echo "$content" | tee "$file" > /dev/null
    fi
}

# -----------------------------------------------------------------------------
# --- AUTOMATIC ENVIRONMENT DETECTION & PATH CONFIGURATION ---
# -----------------------------------------------------------------------------

# Standard Linux Environment
BIN_DIR="/usr/local/bin"
SHEBANG_PATH="#!/usr/bin/env bash"
PYTHON_CMD="python3"
INSTALL_DIR="/opt/$REPO_NAME"
VENV_DIR="$INSTALL_DIR/venv"
VENV_PYTHON="$VENV_DIR/bin/python"

apt install -y jq python3-full python3-venv python3-pip git golang build-essential libpcap-dev clang cmake ffmpeg openssl pkg-config libssl-dev

# -----------------------------------------------------------------------------

echo -e "${GREEN}[!] Start Installation: ${REPO_NAME} [!] ${NC}"

# Check Python and Git
if ! command -v git &> /dev/null; then
    echo -e "${RED}[x] ERROR: Git not found. Install Git first.${NC}"
    exit 1
fi
if ! command -v "$PYTHON_CMD" &> /dev/null; then
    echo -e "${RED}[x] ERROR: Python not found. Make sure $PYTHON_CMD installed.${NC}"
    exit 1
fi

# Installation Directory Preparation
if [ -d "$INSTALL_DIR" ]; then
    echo -e "${GREEN}[-] Remove old installations.${NC}"
    cd ~
    rm -rf "$INSTALL_DIR"
fi

echo -e "${GREEN}[+] Create installation directory${NC}"

# Check CI/CD or Production environment
if [ "$GITHUB_ACTIONS" == "true" ]; then
    echo -e "${GREEN}[*] CI Environment detected${NC}"
    cp -a . "$INSTALL_DIR"
else
    echo -e "${GREEN}[*] Production Environment detected${NC}"
    mkdir -p "$INSTALL_DIR"
    git clone "$GITHUB_REPO" "$INSTALL_DIR"
fi

if [ $? -ne 0 ]; then
    echo -e "${RED}[x] ERROR: Failed to clone repository.${NC}"
    rm -rf "$INSTALL_DIR"
    exit 1
fi

# Validate whether the folder is successfully filled
if [ ! -f "$INSTALL_DIR/pyproject.toml" ]; then
    echo -e "${RED}[x] ERROR: Failed to prepare repository files.${NC}"
    rm -rf "$INSTALL_DIR"
    exit 1
fi

# Install Python Dependencies
if [ -f "$INSTALL_DIR/requirements.txt" ]; then
    echo -e "${GREEN}[+] Installing Python dependencies.${NC}"

    "$PYTHON_CMD" -m venv "$VENV_DIR"
    "$VENV_PYTHON" -m pip install -r "$INSTALL_DIR/requirements.txt"

    if [ $? -ne 0 ]; then
        echo -e "${RED}[x] ERROR: Failed to install Python dependencies.${NC}"
    fi
fi

# --- RUST TOOLCHAIN PREPARATION ---
# Check cargo availability using sudo to detect root environment
if [ ! -f /usr/local/bin/cargo ] || ! /usr/local/bin/cargo --version | grep -q "1.8"; then
    echo -e "${GREEN}[+] Installing modern Rust toolchain for ROOT environment...${NC}"

    # Force full installation using ROOT user
    bash -c "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y"

    # Create a Rust binary symlink from the root directory to the global system
    ln -sf /root/.cargo/bin/cargo /usr/local/bin/cargo
    ln -sf /root/.cargo/bin/rustc /usr/local/bin/rustc
    ln -sf /root/.cargo/bin/rustup /usr/local/bin/rustup

    # Set the default toolchain explicitly specifically for the root user
    # This grants the error request: "run 'rustup default stable'"
    /usr/local/bin/rustup default stable
fi

# Version validation using sudo context
echo -e "${BLUE}[*] Cargo version: $(sudo /usr/local/bin/cargo --version)${NC}"

# ----------------------------------

# Run binary compilation
if [ -d "$INSTALL_DIR" ]; then
    cd "$INSTALL_DIR" || { echo -e "${RED}[x] ERROR: Cannot access $INSTALL_DIR${NC}"; }
fi

# Compilation binary (executed within venv context)
"$VENV_PYTHON" -m scripts.cpl.compiler

cd "$INSTALL_DIR" || { echo -e "${RED}[x] ERROR: Lost track of directory!${NC}"; exit 1; }

# --- Security Identity Generation (Version: The 60-Char Fix) ---
if [ ! -f .env ]; then
    echo -e "[+] Generating unique security keys via OpenSSL..."

    # Generate Private Key
    PRIV_KEY=$(openssl genpkey -algorithm ed25519 2>/dev/null | openssl pkey -outform DER 2>/dev/null | base64 -w 0 | tr -d '[:space:]')

    # Generate Public Key
    PUB_KEY=$(echo -n "$PRIV_KEY" | base64 -d | openssl pkey -inform DER -pubout -outform DER 2>/dev/null | base64 -w 0 | tr -d '[:space:]')

    # This code just adds '=' when PUBKEY is only 59 characters long
    # Rust with its dependencies is very sensitive, it doesn't want anything odd.
    # Storm's security logic is written in Rust, and this Key is to make it run.
    if [ ${#PUB_KEY} -eq 59 ]; then
        PUB_KEY="${PUB_KEY}="
    fi

    # This code will insert the key into .env
    # This is very crucial because if there is only 1 space it will not be usable.
    write_to_file "STORM_PRIVKEY=${PRIV_KEY}" ".env" false
    write_to_file "STORM_PUBKEY=${PUB_KEY}" ".env" true

    echo -e "[✓] Security identity created successfully."
fi

# This ensures that the command always matches the environment.
chmod 600 .env

# Go to data folder
cd "$INSTALL_DIR/data" || { echo -e "${RED}[x] ERROR: Lost track of directory!${NC}"; exit 1; }

# Generate ROOT CA TRUST STORE
if [ -f smf_ca.key ] && [ -f smf_ca.crt ]; then
    echo "[*] CA already exists"
else
    echo "[+] Generate CA Trust Store..."

    # Delete CA long
    rm -f smf_ca.key smf_ca.crt

    # Generate CA private key
    openssl genrsa -out smf_ca.key 2048

    # Allow standard owner read/write
    chmod 600 smf_ca.key

    # Generate self-signed CA certificate
    openssl req -x509 -new -nodes \
        -key smf_ca.key \
        -sha256 \
        -days 3650 \
        -out smf_ca.crt \
        -subj "/CN=Storm Trusted Root CA/O=StormWorld0/OU=Network-Security-Storm" \
        -extensions v3_ca \
        -config <(cat <<-EOF
[req]
distinguished_name = req_distinguished_name
[req_distinguished_name]
[v3_ca]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
EOF
        )

    echo "[✓] Success generate CA Trust Store"
fi

# Go to root folder
cd "$INSTALL_DIR" || { echo -e "${RED}[x] ERROR: Lost track of directory!${NC}"; exit 1; }

# Sign using the isolated venv python
"$VENV_PYTHON" -m scripts.security.sign

# Creating a Dynamic Wrapper Script
WRAPPER_DST="$BIN_DIR/$TOOL_NAME"

# Create wrapper content in variables for easy management
CREATE_WRAPPER=$(cat << EOF
${SHEBANG_PATH}

PROJECT_DIR="$INSTALL_DIR"
VENV_ACTIVATE="\$PROJECT_DIR/venv/bin/activate"

cd "\$PROJECT_DIR" || { echo "[x] ERROR: Failed to access project directory."; exit 1; }

if [ -f "\$VENV_ACTIVATE" ]; then
    source "\$VENV_ACTIVATE"
fi

if [ "\$1" = "--update" ] && [ \$# -eq 1 ]; then
    exec ./smfupdate

elif [ "\$1" = "-cp" ] && [ "\$2" = "-crt" ] && [ \$# -eq 2 ]; then

    if [ ! -f "./data/smf_ca.crt" ]; then
        echo "[x] ERROR: smf_ca.crt not found."
        exit 1
    fi

    TARGET_HOME=\$(getent passwd "\$SUDO_USER" | cut -d: -f6)
    : "\${TARGET_HOME:=\$HOME}"

    cp ./data/smf_ca.crt "\$TARGET_HOME/smf_ca.crt" || { echo "[x] Failed to copy certificate."; exit 1; }

    echo "[+] Certificate copied to: \$TARGET_HOME/smf_ca.crt"

elif [ \$# -eq 0 ]; then

    if [ ! -f "./smfstart" ]; then
        exec ./smfupdate
    else
        exec ./smfstart
    fi

else
    echo "Invalid arguments: \$@"
    exit 1
fi
EOF
)

write_to_file "$CREATE_WRAPPER" "$WRAPPER_DST" false

chmod +x "$WRAPPER_DST"

echo -e "${GREEN}####################################################${NC}"
echo -e "${GREEN}[✓] INSTALLATION COMPLETE${NC}"
echo -e "${GREEN}[✓] PATH STORM: ${INSTALL_DIR}${NC}"
echo -e "${GREEN}[✓] PATH WRAPPER: ${BIN_DIR}/${TOOL_NAME}${NC}"
echo -e "${GREEN}####################################################${NC}"