#!/bin/bash
set -u

PROJECT_DIR="${1:-$(cd "$(dirname "$0")" && pwd)}"
CONFIG="$PROJECT_DIR/config/python-runtime.json"
CACHE="$PROJECT_DIR/.runtime-cache"
LOG_DIR="$PROJECT_DIR/logs"
LOG="$LOG_DIR/python-bootstrap-macos.log"
mkdir -p "$CACHE" "$LOG_DIR"

fail() {
  CODE="$1"
  MESSAGE="$2"
  SUGGESTION="$3"
  printf '[%s] %s\n处理建议：%s\n' "$CODE" "$MESSAGE" "$SUGGESTION" | tee -a "$LOG"
  exit 2
}

[ -f "$CONFIG" ] || fail "PYTHON_RUNTIME_CONFIG_MISSING" "缺少 Python 运行时配置。" "重新解压完整系统 ZIP。"

URL="$(/usr/bin/plutil -extract macos.url raw -o - "$CONFIG" 2>/dev/null)" || fail "PYTHON_RUNTIME_CONFIG_INVALID" "运行时配置无法读取。" "重新下载完整系统 ZIP。"
EXPECTED_SHA256="$(/usr/bin/plutil -extract macos.sha256 raw -o - "$CONFIG" 2>/dev/null)" || fail "PYTHON_RUNTIME_CONFIG_INVALID" "运行时配置无法读取。" "重新下载完整系统 ZIP。"
FILE_NAME="${URL##*/}"
PKG="$CACHE/$FILE_NAME"

case "$URL" in
  https://www.python.org/*) ;;
  *) fail "PYTHON_INSTALLER_SOURCE_REJECTED" "安装包不是 Python 官方 HTTPS 来源。" "只允许使用 www.python.org 的固定版本安装包。" ;;
esac
printf '%s' "$EXPECTED_SHA256" | grep -Eq '^[A-Fa-f0-9]{64}$' || fail "PYTHON_INSTALLER_HASH_MISSING" "安装包 SHA-256 未固定。" "由系统生成方从 Python 官方发布页核对并写入哈希。"

if [ ! -f "$PKG" ]; then
  /usr/bin/curl --fail --location --proto '=https' --tlsv1.2 "$URL" --output "$PKG" || fail "PYTHON_INSTALLER_DOWNLOAD_FAILED" "Python 官方安装包下载失败。" "检查网络，或把已验证官方 PKG 放入 .runtime-cache。"
fi

ACTUAL_SHA256="$(/usr/bin/shasum -a 256 "$PKG" | /usr/bin/awk '{print $1}')"
if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
  /bin/rm -f "$PKG"
  fail "PYTHON_INSTALLER_HASH_MISMATCH" "Python 安装包哈希不匹配，已停止安装。" "不要使用该文件；重新从官方来源获取。"
fi

/usr/sbin/pkgutil --check-signature "$PKG" > "$CACHE/pkg-signature.txt" 2>&1 || fail "PYTHON_INSTALLER_SIGNATURE_INVALID" "Python 安装包签名验证失败。" "只使用 Python Software Foundation 签名的官方 PKG。"
/usr/bin/grep -q "Python Software Foundation" "$CACHE/pkg-signature.txt" || fail "PYTHON_INSTALLER_PUBLISHER_INVALID" "Python 安装包发布者不正确。" "只使用 Python Software Foundation 签名的官方 PKG。"

printf '[PYTHON_ADMIN_AUTH_REQUIRED] macOS 将显示系统管理员授权窗口；拒绝授权不会安装。\n'
/usr/bin/osascript -e "do shell script \"/usr/sbin/installer -pkg '$PKG' -target /\" with administrator privileges" || fail "PYTHON_ADMIN_INSTALL_DENIED" "管理员授权被拒绝或 Python 安装失败。" "请由电脑管理员完成官方 Python 安装后重新启动。"

PYTHON_PATH=""
for candidate in /Library/Frameworks/Python.framework/Versions/*/bin/python3 /usr/local/bin/python3; do
  if [ -x "$candidate" ]; then
    PYTHON_PATH="$candidate"
  fi
done
[ -n "$PYTHON_PATH" ] || fail "PYTHON_INSTALL_VERIFY_FAILED" "安装后未找到受支持的 Python。" "查看安装日志并联系管理员。"
"$PYTHON_PATH" -c 'import sys; raise SystemExit(0 if sys.version_info >= (3,10) else 1)' || fail "PYTHON_INSTALL_VERIFY_FAILED" "安装后的 Python 版本低于 3.10。" "安装受支持的官方版本。"
printf '[PYTHON_INSTALL_OK] Python 已安装并验证：%s\n' "$PYTHON_PATH" | tee -a "$LOG"
exit 0
