#!/usr/bin/env bash

# 1. Architecture Detection
machine=$(uname -m)
if [[ ${machine} == "x86_64" ]]; then
  ARCH="amd64"
elif [[ ${machine} == "aarch64" ]]; then
  ARCH="arm64"
else
  echo "Unsupported architecture: ${machine}"
  exit 1
fi

# 2. Variables & Configuration
APP="brave-browser"
BRANCH="-dev" # Options: "", "-beta", "-nightly", "-dev"
UBUNTU_CODENAME="stable"
URL="brave-browser-apt${BRANCH}.s3.brave.com"

# DEB822 Specific Fields
TYPES="deb"
URIs="https://${URL}/"
SUITES="${UBUNTU_CODENAME}"
COMPONENTS="main"

# Directory for modern GPG keyrings
KEY_DIR="/usr/share/keyrings"
KEY="${KEY_DIR}/${APP}${BRANCH}-archive-keyring.gpg"
# Note: DEB822 files must end in .sources
SOURCES_NAME="${APP}${BRANCH}-${UBUNTU_CODENAME}.sources"

# 3. Ensure directories exist
sudo mkdir -p "${KEY_DIR}"
sudo mkdir -p /etc/apt/sources.list-available

# 4. Fetch GPG Key
sudo curl -fsSLo "${KEY}" "https://${URL}/brave-browser-archive-keyring.gpg"

# 5. Define deb822 Source Template
conf_print_brave_sources() {
  cat <<EOF
Enabled: yes
Types: ${TYPES}
URIs: ${URIs}
Suites: ${SUITES}
Components: ${COMPONENTS}
Architectures: ${ARCH}
Signed-By: ${KEY}
EOF
}

# 6. Deploy Sources File (Available)
conf_print_brave_sources | sudo tee "/etc/apt/sources.list-available/${SOURCES_NAME}" >/dev/null

# 7. Enable via Symlink
# For DEB822, the file in sources.list.d must end in .sources to be recognized
sudo ln -sf "/etc/apt/sources.list-available/${SOURCES_NAME}" "/etc/apt/sources.list.d/${SOURCES_NAME}"

# 8. Install
sudo apt update
sudo apt install "${APP}${BRANCH}" -y

# 9. System Hardening / Sandbox Fix
echo 'kernel.unprivileged_userns_clone=1' | sudo tee /etc/sysctl.d/00-local-userns.conf >/dev/null
sudo sysctl -p /etc/sysctl.d/00-local-userns.conf >/dev/null

# 10. Bypass apt-proxy for Brave repo
PROXY_CONF="/etc/apt/apt.conf.d/02proxy"
PROXY_LINE="Acquire::https::Proxy { \"${URL}\" DIRECT; };"

if [ -f "$PROXY_CONF" ]; then
  if ! grep -q "${URL}" "$PROXY_CONF"; then
    echo "$PROXY_LINE" | sudo tee -a "$PROXY_CONF" >/dev/null
  fi
else
  echo "$PROXY_LINE" | sudo tee "$PROXY_CONF" >/dev/null
fi