# SOFTGIT: download an app and verify its SHA-256 checksum.
#
#   & ([scriptblock]::Create((irm https://softgit.pro/get.ps1))) <app>
#
# <app> is the last part of the app page address: https://softgit.pro/p/<app>
# The file is saved in the current folder and opened with the default app once it is verified
# (set $env:SHOWCASE_NO_OPEN = 1 to skip opening). Works in Windows PowerShell 5.1 and PowerShell 7+.
param([Parameter(Position = 0)][string]$Slug)

$ErrorActionPreference = 'Stop'
$ProgressPreference = 'SilentlyContinue'
$Site = 'https://softgit.pro'
if ($env:SHOWCASE_URL) { $Site = $env:SHOWCASE_URL }
$Site = $Site.TrimEnd('/')

if (-not $Slug) { Write-Host "Usage: & ([scriptblock]::Create((irm $Site/get.ps1))) <app>"; return }
if ($Slug -notmatch '^[A-Za-z0-9._-]+$') { Write-Host "Error: invalid app name: $Slug" -ForegroundColor Red; return }
try { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 } catch { }

try { $info = Invoke-RestMethod -Uri "$Site/api/download-info?slug=$Slug" -UseBasicParsing }
catch { Write-Host "Error: app '$Slug' was not found on $Site" -ForegroundColor Red; return }
$f = $info.file
if (-not $f -or -not $f.url) { Write-Host "Error: '$Slug' has no downloadable file on $Site" -ForegroundColor Red; return }

$url = [string]$f.url
if ($url.StartsWith('/')) { $url = $Site + $url }
elseif ($url -notmatch '^https?://') { Write-Host "Error: no download address for '$Slug'" -ForegroundColor Red; return }
$name = (([string]$f.name -split '[\\/]')[-1] -replace '[^A-Za-z0-9._+-]', '_') -replace '^[.-]+', ''
if (-not $name) { $name = "$Slug.download" }
$out = Join-Path (Get-Location).ProviderPath $name
function Open-Download {
  if ($env:SHOWCASE_NO_OPEN) { return }
  Write-Host "Opening $name ..."
  try { Invoke-Item -LiteralPath $out } catch { Write-Host "Note: the file could not be opened automatically: $($_.Exception.Message)" -ForegroundColor Yellow }
}

Write-Host "Downloading $name from $Site ..."
if ($f.external) { Write-Host "This file is served by its official mirror (SourceForge), not hosted on $Site." }
try { Invoke-WebRequest -Uri $url -OutFile $out -UseBasicParsing }
catch { Write-Host "Error: download failed: $($_.Exception.Message)" -ForegroundColor Red; return }

$expected = ([string]$f.sha256).Trim().ToLowerInvariant()
if (-not $expected) {
  Write-Host 'WARNING: no SHA-256 checksum is published for this file, so it cannot be verified automatically.' -ForegroundColor Yellow
  Write-Host "Saved: $out"
  Open-Download
  return
}
$actual = (Get-FileHash -LiteralPath $out -Algorithm SHA256).Hash.ToLowerInvariant()
if ($actual -eq $expected) {
  Write-Host "OK: checksum matches ($expected)" -ForegroundColor Green
  Write-Host "Saved: $out"
  Open-Download
} else {
  Write-Host 'WARNING: checksum mismatch!' -ForegroundColor Red
  Write-Host "  expected: $expected"
  Write-Host "  actual:   $actual"
  Write-Host "Do not open this file. Delete it and try again, and please let us know: $Site/security" -ForegroundColor Red
}