#!/usr/bin/env bash
set -u

BASE_URL='https://kex.slft.yuukocae.xyz'
AUTH_URL="$BASE_URL/api/authorize"
DOWNLOAD_URL="$BASE_URL/api/download"
MAX_ATTEMPTS=3
attempt=1
auth_file=""
download_tmp=""
example_tmp=""

cleanup() {
  if [ -n "$auth_file" ]; then rm -f -- "$auth_file"; fi
  if [ -n "$download_tmp" ]; then rm -f -- "$download_tmp"; fi
  if [ -n "$example_tmp" ]; then rm -f -- "$example_tmp"; fi
}
trap cleanup EXIT

if ! command -v curl >/dev/null 2>&1; then
  printf '%s\n' '找不到 curl，请先安装 curl。' >&2
  exit 1
fi
if [ ! -r /dev/tty ] || [ ! -w /dev/tty ]; then
  printf '%s\n' '需要交互式终端才能输入令牌；请在终端中运行此命令。' >&2
  exit 1
fi

auth_file="$(mktemp "${TMPDIR:-/tmp}/cf-worker-auth.XXXXXX")" || {
  printf '%s\n' '无法创建临时文件，操作终止。' >&2
  exit 1
}

while [ "$attempt" -le "$MAX_ATTEMPTS" ]; do
  printf "请输入令牌（第 %s/%s 次）: " "$attempt" "$MAX_ATTEMPTS" > /dev/tty
  if ! IFS= read -r -s token < /dev/tty; then
    printf '\n%s\n' '读取令牌失败，操作终止。' >&2
    exit 1
  fi
  printf '\n' > /dev/tty

  auth_status=401
  if [ -n "$token" ]; then
    if auth_status="$(
      printf '%s' "$token" | curl --silent --show-error --connect-timeout 10 --max-time 30 --request POST --header 'content-type: text/plain; charset=utf-8' --data-binary @- --output "$auth_file" --write-out '%{http_code}' "$AUTH_URL"
    )"; then
      :
    else
      auth_status=000
    fi
  fi

  if [ "$auth_status" = "200" ]; then
    username="$(sed -n '1p' "$auth_file")"
    download_name="$(sed -n '2p' "$auth_file")"
    if [ -z "$username" ] || [ -z "$download_name" ]; then
      printf '%s\n' '服务返回了无效的授权信息，操作终止。' >&2
      exit 1
    fi
    printf "你来了，%s。我好开心。\n" "$username" > /dev/tty
    break
  fi

  if [ "$auth_status" = "401" ]; then
    if [ "$attempt" -eq "$MAX_ATTEMPTS" ]; then
      printf "令牌无效，已失败 %s 次，连接终止。\n" "$MAX_ATTEMPTS" >&2
      exit 1
    fi
    remaining=$((MAX_ATTEMPTS - attempt))
    printf "令牌无效，请重试（还可尝试 %s 次）。\n" "$remaining" >&2
    attempt=$((attempt + 1))
    continue
  fi

  if [ "$auth_status" = "000" ]; then
    printf '%s\n' '无法连接到 Worker，操作终止。' >&2
  else
    printf "Worker 返回异常状态（HTTP %s），操作终止。\n" "$auth_status" >&2
  fi
  exit 1
done

if [[ ! "$download_name" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]] || [ "$download_name" = "example.txt" ]; then
  printf '%s\n' '服务返回了不安全的文件名，操作终止。' >&2
  exit 1
fi
download_tmp="$(mktemp "$PWD/.cf-worker-download.XXXXXX")" || {
  printf '%s\n' '无法在当前工作目录创建临时文件。' >&2
  exit 1
}

printf "正在下载 %s ...\n" "$download_name" > /dev/tty
if ! printf '%s' "$token" | curl --fail --silent --show-error --connect-timeout 10 --max-time 300 --request POST --header 'content-type: text/plain; charset=utf-8' --data-binary @- --output "$download_tmp" "$DOWNLOAD_URL"; then
  printf '%s\n' '文件下载失败，操作终止。' >&2
  exit 1
fi
target="$PWD/$download_name"
if [ -d "$target" ]; then
  printf '%s\n' '当前工作目录已有同名目录，无法保存下载文件。' >&2
  exit 1
fi
if ! mv -f -- "$download_tmp" "$target"; then
  printf '%s\n' '无法将下载文件保存到当前工作目录。' >&2
  exit 1
fi
download_tmp=""
if [ -d "$PWD/example.txt" ]; then
  printf '%s\n' '当前工作目录中的 example.txt 是目录，无法替换。' >&2
  exit 1
fi
example_tmp="$(mktemp "$PWD/.cf-worker-example.XXXXXX")" || {
  printf '%s\n' '无法在当前工作目录创建 example.txt 的临时文件。' >&2
  exit 1
}
if ! printf %s example > "$example_tmp"; then
  printf '%s\n' '无法写入 example.txt。' >&2
  exit 1
fi
if ! mv -f -- "$example_tmp" "$PWD/example.txt"; then
  printf '%s\n' '无法创建 example.txt。' >&2
  exit 1
fi
example_tmp=""
printf "下载完成：%s\n已创建：%s/example.txt\n" "$target" "$PWD" > /dev/tty
token=""