#!/usr/bin/env bash
#
# HYVE Ether OS - Activation Recovery (for the 1.0.8 install image)
# =============================================================================
# WHAT THIS FIXES
#   On the 1.0.8 install image, the on-device license verifier answered the
#   activation screen's browser preflight with an
#   "Access-Control-Allow-Headers: *" header that the OS's built-in webview
#   rejects. The activation screen therefore could not reach the verifier, so a
#   perfectly valid key would not activate -- you'd see "that key didn't verify"
#   or "the activation service isn't started yet." Your key was never the
#   problem; the screen simply couldn't talk to the local verifier.
#
# WHAT THIS DOES
#   Corrects that single HTTP header in the local verifier and restarts it.
#   It does NOT touch your license key, the verifier's signing keys, or any of
#   your data. It is 100% local -- this script makes no network calls of its own
#   (you fetch it once; after that it only edits a local file).
#
# HOW TO RUN  (if you're stuck on the activation screen)
#   1. Press  Ctrl+Alt+F3  to reach a text login. Sign in with your username.
#   2. Fetch and run this script:
#        curl -fsSLO https://hyveether.com/downloads/hyve-activation-fix.sh
#        bash hyve-activation-fix.sh
#   3. Reboot:  sudo reboot
#   4. Back at the activation screen, enter your key -- it will activate, and
#      it stays activated across reboots.
#
# A timestamped backup of the verifier is saved next to it before any change,
# so this is fully reversible.
# =============================================================================
set -euo pipefail

DEPOT="/opt/hyve-organs/depot/server.py"
BROKEN='Access-Control-Allow-Headers", "*"'

echo "HYVE Ether OS - Activation Recovery"
echo "-----------------------------------"

if [ ! -f "$DEPOT" ]; then
  echo "ERROR: the license verifier was not found at:"
  echo "       $DEPOT"
  echo "This script only applies to HYVE Ether OS installs. Nothing was changed."
  exit 1
fi

if grep -qF "$BROKEN" "$DEPOT"; then
  sudo cp -a "$DEPOT" "${DEPOT}.bak-activationfix-$(date +%s)"
  sudo sed -i 's|Access-Control-Allow-Headers", "\*"|Access-Control-Allow-Headers", "content-type"|' "$DEPOT"
  echo "  [1/2] Corrected the verifier's preflight header (backup saved)."
else
  echo "  [1/2] Already corrected on this machine -- no change needed."
fi

# Restart the verifier so the fix takes effect immediately.
UNIT="$(systemctl list-units --all -t service --no-legend 2>/dev/null \
        | grep -io '[a-z0-9-]*depot[a-z0-9-]*\.service' | head -1)"
if [ -n "$UNIT" ] && sudo systemctl restart "$UNIT"; then
  echo "  [2/2] Restarted $UNIT."
else
  echo "  [2/2] Verifier will pick up the fix on your next reboot."
fi

sleep 2
# Confirm the preflight now advertises the header the activation screen needs.
RESP="$(curl -s -i -X OPTIONS http://127.0.0.1:7910/license/verify \
          -H 'Origin: http://tauri.localhost' \
          -H 'Access-Control-Request-Method: POST' \
          -H 'Access-Control-Request-Headers: content-type' 2>/dev/null \
        | grep -i 'access-control-allow-headers' | tr -d '\r' || true)"
echo
echo "Verifier now answers:  ${RESP:-<no response yet -- reboot and it will apply>}"
echo
echo "DONE.  Now run:  sudo reboot"
echo "Then enter your key on the activation screen. It will activate."