#!/usr/bin/env python3
"""Local installer for the reviewed BakarServer client; never downloads or executes payloads."""
import argparse, hashlib, os, pathlib, tempfile

EXPECTED_SHA256 = '32e603b3354bf1bcb21ee385282ca6886424da5163c2a980f4c889aed00ee938'

def main():
    p=argparse.ArgumentParser(description='Install only the BakarServer subscription client. No root access, cron, vendor files or system configuration changes are needed.')
    p.add_argument('--bin-dir',type=pathlib.Path,default=pathlib.Path.home()/'.local/bin')
    p.add_argument('--replace',action='store_true',help='Replace an existing bakar-client file explicitly')
    a=p.parse_args()
    src=pathlib.Path(__file__).resolve().parent/'bakar-client.py'
    data=src.read_bytes()
    if hashlib.sha256(data).hexdigest()!=EXPECTED_SHA256:raise SystemExit('Client checksum does not match this release. Nothing installed.')
    compile(data,str(src),'exec')
    folder=a.bin_dir.expanduser().absolute();folder.mkdir(parents=True,exist_ok=True)
    dest=folder/'bakar-client'
    if dest.is_symlink():raise SystemExit('Refusing a symbolic-link installation target.')
    if dest.exists() and not a.replace:raise SystemExit('Client already exists. Use its update command, or pass --replace to reinstall this release.')
    fd,tmp=tempfile.mkstemp(prefix='.bakar-client-',dir=str(folder))
    try:
        os.fchmod(fd,0o755)
        with os.fdopen(fd,'wb') as f:f.write(data);f.flush();os.fsync(f.fileno())
        os.replace(tmp,dest)
    finally:
        if os.path.exists(tmp):os.unlink(tmp)
    print('Installed '+str(dest))
    print('Next: '+str(dest)+' enroll')
    print('No token, scheduled job, vendor file or license was changed.')

if __name__=='__main__':main()