#!/bin/bash
# Kedemo for Mac — installs the agent as a system service (LaunchDaemon) and
# links this Mac to your family with the code from the parent panel.
#
#   curl -fsSL https://kedemo.com/downloads/install-mac.sh | sudo bash -s -- -token <code> [-url https://api.kedemo.com] [-site https://kedemo.com]
#
# (Piped straight into bash — never saved to a shared folder like /tmp, where
# another account could swap it before sudo runs it.)
#
# Remove later with:  sudo "/Library/Application Support/Kedemo/kedemo" uninstall
# (asks for the family master password).
set -euo pipefail

TOKEN="" URL="" SITE="https://kedemo.com" BIN=""
while [ $# -gt 0 ]; do
  case "$1" in
    -token) TOKEN="$2"; shift 2 ;;
    -url)   URL="$2"; shift 2 ;;
    -site)  SITE="${2%/}"; shift 2 ;;
    -bin)   BIN="$2"; shift 2 ;;   # use a local binary instead of downloading
    *) echo "unknown option: $1" >&2; exit 2 ;;
  esac
done

[ "$(id -u)" = "0" ] || { echo "Run with sudo." >&2; exit 1; }
[ "$(uname -s)" = "Darwin" ] || { echo "This installer is for macOS." >&2; exit 1; }
[ -n "$URL" ] || URL="$SITE"
case "$URL" in https://*) ;; *) echo "-url must start with https://" >&2; exit 1 ;; esac
case "$SITE" in https://*) ;; *) echo "-site must start with https://" >&2; exit 1 ;; esac

DIR="/Library/Application Support/Kedemo"
PLIST="/Library/LaunchDaemons/com.kedemo.agent.plist"
LOGS="/Library/Logs/Kedemo"
ARCH="$(uname -m)"; [ "$ARCH" = "arm64" ] || ARCH="amd64"
NAME="kedemo-mac-$ARCH"
TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

if [ -z "$BIN" ]; then
  echo "Downloading Kedemo ($ARCH)…"
  curl -fsSL "$SITE/downloads/$NAME" -o "$TMP/kedemo"
  curl -fsSL "$SITE/downloads/latest.json" -o "$TMP/latest.json" || true
  WANT="$(/usr/bin/plutil -extract "sha256.$NAME" raw -o - "$TMP/latest.json" 2>/dev/null || true)"
  if [ -n "$WANT" ]; then
    GOT="$(/usr/bin/shasum -a 256 "$TMP/kedemo" | awk '{print $1}')"
    [ "$GOT" = "$WANT" ] || { echo "Download is damaged (checksum mismatch) — try again." >&2; exit 1; }
  fi
  BIN="$TMP/kedemo"
fi

echo "Installing…"
/bin/launchctl bootout system/com.kedemo.agent 2>/dev/null || true
/bin/mkdir -p "$DIR" "$LOGS"
/usr/bin/install -o root -g wheel -m 0755 "$BIN" "$DIR/kedemo"
/usr/bin/xattr -d com.apple.quarantine "$DIR/kedemo" 2>/dev/null || true
/usr/sbin/chown root:wheel "$DIR" "$LOGS"
/bin/chmod 0755 "$DIR"
/bin/chmod 0700 "$LOGS"

if [ -n "$TOKEN" ]; then
  "$DIR/kedemo" enroll -token "$TOKEN" -url "$URL"
fi
[ -f "$DIR/agent-state.json" ] && /bin/chmod 0600 "$DIR/agent-state.json"

cat > "$PLIST" <<PL
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.kedemo.agent</string>
  <key>ProgramArguments</key>
  <array><string>$DIR/kedemo</string><string>run</string></array>
  <key>RunAtLoad</key><true/>
  <key>KeepAlive</key><true/>
  <key>ThrottleInterval</key><integer>10</integer>
  <key>StandardOutPath</key><string>$LOGS/agent.log</string>
  <key>StandardErrorPath</key><string>$LOGS/agent.log</string>
</dict>
</plist>
PL
/usr/sbin/chown root:wheel "$PLIST"
/bin/chmod 0644 "$PLIST"
/bin/launchctl bootstrap system "$PLIST"
/bin/launchctl enable system/com.kedemo.agent

echo "Done. This Mac appears in your Kedemo panel within a minute."
if /usr/bin/dscl . read /Groups/admin GroupMembership 2>/dev/null | grep -qw "$(stat -f %Su /dev/console)"; then
  echo "Tip: your child's account is an administrator — make it a Standard account (System Settings → Users & Groups) so Kedemo can't be removed."
fi