refactor: isolate enrollment authorization from handshake

scripts/installer.sh

@@ -28,6 +28,7 @@ log_info "Installer Root: $INSTALLER_ROOT"
 run_module "$SCRIPT_DIR/modules/00_preflight.sh" "always"
 run_module "$SCRIPT_DIR/modules/05_network.sh" "always"
 run_module "$SCRIPT_DIR/modules/10_hardware.sh" "always"
+run_module "$SCRIPT_DIR/modules/12_enrollment_auth.sh" "always"
 run_module "$SCRIPT_DIR/modules/15_server_handshake.sh" "always"
 run_module "$SCRIPT_DIR/modules/17_device_status.sh" "always"
 PROVISIONING_STATE_FILE="/run/tuxflotte/provisioning/state.env"

scripts/modules/12_enrollment_auth.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+readonly SCRIPT_NAME="${0##*/}"
+
+readonly RUNTIME_DIR="/run/tuxflotte/enrollment"
+readonly AUTHORIZATION_FILE="${RUNTIME_DIR}/authorization.json"
+
+log() {
+    printf '[%s] %s\n' "${SCRIPT_NAME}" "$*" >&2
+}
+
+fatal() {
+    printf '[%s] FEHLER: %s\n' "${SCRIPT_NAME}" "$*" >&2
+    exit 1
+}
+
+require_root() {
+    if [[ "${EUID}" -ne 0 ]]; then
+        fatal "Das Enrollment-Autorisierungsmodul muss als root ausgeführt werden."
+    fi
+}
+
+prepare_runtime_directory() {
+    install -d \
+        --mode=0700 \
+        --owner=root \
+        --group=root \
+        "${RUNTIME_DIR}"
+
+    rm -f -- "${AUTHORIZATION_FILE}"
+}
+
+store_bootstrap_authorization() {
+    local activation_code
+
+    activation_code="${TUXFLOTTE_ACTIVATION_CODE:-LAB-2026-START}"
+
+    jq \
+        --null-input \
+        --arg activation_code "${activation_code}" \
+        '{
+            schema_version: 1,
+            authorization_type: "bootstrap_activation_code",
+            activation_code: $activation_code
+        }' >"${AUTHORIZATION_FILE}"
+
+    chmod 0600 "${AUTHORIZATION_FILE}"
+}
+
+validate_authorization() {
+    jq --exit-status '
+        .schema_version == 1
+        and .authorization_type == "bootstrap_activation_code"
+        and (.activation_code | type == "string")
+        and (.activation_code | length > 0)
+    ' "${AUTHORIZATION_FILE}" >/dev/null ||
+        fatal "Enrollment-Autorisierung ist ungültig."
+}
+
+main() {
+    require_root
+    prepare_runtime_directory
+    store_bootstrap_authorization
+    validate_authorization
+
+    log "Temporäre Bootstrap-Autorisierung wurde vorbereitet."
+}
+
+main "$@"

scripts/modules/15_server_handshake.sh

@@ -9,7 +9,7 @@ readonly HARDWARE_FILE="/run/tuxflotte/hardware/hardware.json"
 
 readonly RUNTIME_DIR="/run/tuxflotte/server"
 readonly ACTIVATION_FILE="${RUNTIME_DIR}/activation.json"
-
+readonly AUTHORIZATION_FILE="/run/tuxflotte/enrollment/authorization.json"
 readonly RESPONSE_FILE="${RUNTIME_DIR}/response.json"
 
 log() {
@@ -46,6 +46,17 @@ validate_inputs() {
 
     jq --exit-status . "${HARDWARE_FILE}" >/dev/null ||
         fatal "Hardwaredatei enthält kein gültiges JSON."
+
+    [[ -r "${AUTHORIZATION_FILE}" ]] ||
+    fatal "Enrollment-Autorisierung nicht gefunden: ${AUTHORIZATION_FILE}"
+
+    jq --exit-status '
+        .schema_version == 1
+        and .authorization_type == "bootstrap_activation_code"
+        and (.activation_code | type == "string")
+        and (.activation_code | length > 0)
+    ' "${AUTHORIZATION_FILE}" >/dev/null ||
+        fatal "Enrollment-Autorisierung ist ungültig."
 }
 
 build_activation_request() {
@@ -121,7 +132,13 @@ main() {
 
     local activation_code
 
-    activation_code="${TUXFLOTTE_ACTIVATION_CODE:-LAB-2026-START}"
+    local activation_code
+
+    activation_code="$(
+        jq --raw-output \
+            '.activation_code' \
+            "${AUTHORIZATION_FILE}"
+    )"
 
     build_activation_request "${activation_code}" >"${ACTIVATION_FILE}"