#!/usr/bin/env bash
# ==============================================================================
# 模块：Sing-box 官方二进制安装、版本管理与 Systemd 服务管理
# ==============================================================================

# 获取官方最新版本号
get_latest_singbox_version() {
    local version=""
    # 优先尝试 GitHub API
    version=$(curl -sL --max-time 5 "https://api.github.com/repos/SagerNet/sing-box/releases/latest" 2>/dev/null | jq -r '.tag_name' 2>/dev/null | sed 's/^v//')
    
    # 备用方案：重定向网页抓取
    if [[ -z "$version" || "$version" == "null" ]]; then
        version=$(curl -sL --max-time 5 "https://github.com/SagerNet/sing-box/releases/latest" 2>/dev/null | grep -oP 'tag/v\K[0-9.]+' | head -n 1)
    fi

    # 兜底固定稳定版本 (如果 GitHub 无法连接)
    if [[ -z "$version" || "$version" == "null" ]]; then
        version="1.11.0"
    fi

    echo "$version"
}

# 下载并安装官方原版 Sing-box 二进制
install_singbox_binary() {
    local arch
    arch=$(detect_arch) || return 1

    local version
    version=$(get_latest_singbox_version)
    log_info "准备安装 Sing-box 官方核心版本: v${version} (架构: ${arch})..."

    local pkg_name="sing-box-${version}-linux-${arch}"
    local download_url="https://github.com/SagerNet/sing-box/releases/download/v${version}/${pkg_name}.tar.gz"
    local temp_tar="/tmp/${pkg_name}.tar.gz"
    local temp_dir="/tmp/${pkg_name}"

    log_info "正在从 GitHub Releases 官方通道下载..."
    if ! curl -L --fail --retry 3 --connect-timeout 10 -o "$temp_tar" "$download_url"; then
        log_error "下载 Sing-box 失败，请检查服务器连接 GitHub 的网络状况！"
        return 1
    fi

    # 解压并部署
    rm -rf "$temp_dir"
    mkdir -p "$temp_dir"
    tar -xzf "$temp_tar" -C /tmp/ || {
        log_error "解压 Sing-box 压缩包失败！"
        rm -f "$temp_tar"
        return 1
    }

    mkdir -p "${BIN_DIR}"
    cp -f "${temp_dir}/sing-box" "${BIN_PATH}"
    chmod +x "${BIN_PATH}"
    chown root:root "${BIN_PATH}"

    # 清理临时下载文件
    rm -rf "$temp_tar" "$temp_dir"

    # 验证是否可用
    if ! "${BIN_PATH}" version >/dev/null 2>&1; then
        log_error "Sing-box 二进制文件执行测试失败！"
        return 1
    fi

    local installed_ver
    installed_ver=$("${BIN_PATH}" version | head -n 1)
    log_success "Sing-box 核心安装成功: ${installed_ver}"
    return 0
}

# 配置安全可靠的 Systemd 服务文件
setup_systemd_service() {
    log_info "配置 Sing-box Systemd 系统守护进程..."

    cat > "${SERVICE_FILE}" <<EOF
[Unit]
Description=Sing-box Service
Documentation=https://sing-box.sagernet.org
After=network.target nss-lookup.target

[Service]
Type=simple
User=root
WorkingDirectory=${INSTALL_DIR}
ExecStart=${BIN_PATH} run -c ${CONFIG_FILE}
Restart=on-failure
RestartSec=5s
LimitNOFILE=65535
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW

[Install]
WantedBy=multi-user.target
EOF

    systemctl daemon-reload
    systemctl enable "${SERVICE_NAME}" >/dev/null 2>&1
    log_success "Systemd 守护服务配置完成！"
}

# 服务启停控制
start_service() {
    systemctl start "${SERVICE_NAME}"
}

stop_service() {
    systemctl stop "${SERVICE_NAME}"
}

restart_service() {
    systemctl restart "${SERVICE_NAME}"
}

is_service_active() {
    systemctl is-active --quiet "${SERVICE_NAME}"
}