#!/usr/bin/env bash
# download_wroclaw.sh
# Run: bash download_wroclaw.sh [curl|wget] [data-directory]
set -euo pipefail

METHOD=${1:-curl}
DATA_DIR=${2:-data}
if [[ $# -gt 2 || ( "$METHOD" != curl && "$METHOD" != wget ) || -z "$DATA_DIR" ]]; then
    printf '%s\n' 'Usage: bash download_wroclaw.sh [curl|wget] [data-directory]' >&2
    exit 2
fi
: "${ACCESS_TOKEN:?Authenticate with NSIS in this terminal first}"
for TOOL in curl jq unzip awk grep "$METHOD"; do
    command -v "$TOOL" >/dev/null
done
mkdir -p -- "$DATA_DIR"

while read -r PERIOD PRODUCT_ID PRODUCT_NAME; do
    ARCHIVE="$DATA_DIR/$PRODUCT_NAME.zip"
    METADATA="$DATA_DIR/$PERIOD-metadata.json"
    if [[ -e "$ARCHIVE" || -e "$ARCHIVE.part" || -e "$DATA_DIR/$PRODUCT_NAME" ]]; then
        printf 'An output already exists for %s. Inspect it before retrying.\n' "$PRODUCT_NAME" >&2
        exit 1
    fi

    curl --fail --silent --show-error --get \
        --data-urlencode "\$filter=Id eq $PRODUCT_ID" \
        --data-urlencode '$expand=Locations' \
        --output "$METADATA" \
        'https://catalogue.nsiscloud.polsa.gov.pl/odata/v1/Products'

    if ! PRODUCT_URL=$(jq -er --arg id "$PRODUCT_ID" --arg name "$PRODUCT_NAME" '
        .value | select(length == 1) | .[0]
        | select(.Id == $id and .Name == $name and .Online == true)
        | [.Locations[]? | select(.FormatType == "Extracted") | .DownloadLink][0]
        | select(type == "string" and length > 0)
    ' "$METADATA"); then
        printf 'No usable download link was returned for %s.\n' "$PRODUCT_NAME" >&2
        exit 1
    fi
    case "$PRODUCT_URL" in
        https://catalogue.nsiscloud.polsa.gov.pl/*|https://download.nsiscloud.polsa.gov.pl/*) ;;
        *) printf '%s\n' 'Unexpected product URL' >&2; exit 1 ;;
    esac

    printf 'Downloading %s with %s\n' "$PRODUCT_NAME" "$METHOD"
    if [[ "$METHOD" == curl ]]; then
        curl --fail --show-error --location-trusted --proto '=https' --proto-redir '=https' \
            --header "Authorization: Bearer $ACCESS_TOKEN" \
            --output "$ARCHIVE.part" "$PRODUCT_URL"
    else
        wget --https-only --tries=1 \
            --header "Authorization: Bearer $ACCESS_TOKEN" \
            --output-document "$ARCHIVE.part" "$PRODUCT_URL"
    fi
    test -s "$ARCHIVE.part"
    unzip -t "$ARCHIVE.part"
    unzip -Z1 "$ARCHIVE.part" > "$ARCHIVE.members.txt"
    if ! awk -v root="$PRODUCT_NAME/" '
        index($0, root) != 1 || $0 ~ /(^|\/)\.\.(\/|$)/ || index($0, "\\") { bad = 1 }
        END { exit bad }
    ' "$ARCHIVE.members.txt"; then
        printf '%s\n' 'The ZIP contains a path outside the expected SAFE directory.' >&2
        exit 1
    fi
    grep -Fx "$PRODUCT_NAME/MTD_MSIL2A.xml" "$ARCHIVE.members.txt" >/dev/null
    mv -- "$ARCHIVE.part" "$ARCHIVE"
    unzip -n "$ARCHIVE" -d "$DATA_DIR"
    test -f "$DATA_DIR/$PRODUCT_NAME/MTD_MSIL2A.xml"
    printf 'Product ready: %s/%s\n' "$DATA_DIR" "$PRODUCT_NAME"
done <<'PRODUCTS'
before 3ef54189-a223-43fd-ab03-13010274a96b S2B_MSIL2A_20240906T095549_N0511_R122_T33UXS_20240906T160538.SAFE
during e0d748d9-6190-46a7-b9e2-a1c898e5a686 S2A_MSIL2A_20240921T100031_N0511_R122_T33UXS_20240921T123352.SAFE
PRODUCTS