From 262fa88057fbc2d34ce65190acf56446550dcb62 Mon Sep 17 00:00:00 2001
From: Thomas Stallinger <stallinger@gmx.de>
Date: Tue, 14 Jul 2026 13:39:56 +0200
Subject: [PATCH] refactor: isolate enrollment authorization from handshake

---
 scripts/installer.sh                   |  1 +
 scripts/modules/12_enrollment_auth.sh  | 71 ++++++++++++++++++++++++++
 scripts/modules/15_server_handshake.sh | 21 +++++++-
 3 files changed, 91 insertions(+), 2 deletions(-)
 create mode 100755 scripts/modules/12_enrollment_auth.sh

diff --git a/scripts/installer.sh b/scripts/installer.sh
index 9570e5b..06d1995 100755
--- a/scripts/installer.sh
+++ b/scripts/installer.sh
@@ -28,6 +28,7 @@ log_info "Installer Root: $INSTALLER_ROOT"
 run_module "$SCRIPT_DIR/modules/00_preflight.sh" "always"
 run_module "$SCRIPT_DIR/modules/05_network.sh" "always"
 run_module "$SCRIPT_DIR/modules/10_hardware.sh" "always"
+run_module "$SCRIPT_DIR/modules/12_enrollment_auth.sh" "always"
 run_module "$SCRIPT_DIR/modules/15_server_handshake.sh" "always"
 run_module "$SCRIPT_DIR/modules/17_device_status.sh" "always"
 PROVISIONING_STATE_FILE="/run/tuxflotte/provisioning/state.env"
diff --git a/scripts/modules/12_enrollment_auth.sh b/scripts/modules/12_enrollment_auth.sh
new file mode 100755
index 0000000..f8d5525
--- /dev/null
+++ b/scripts/modules/12_enrollment_auth.sh
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+readonly SCRIPT_NAME="${0##*/}"
+
+readonly RUNTIME_DIR="/run/tuxflotte/enrollment"
+readonly AUTHORIZATION_FILE="${RUNTIME_DIR}/authorization.json"
+
+log() {
+    printf '[%s] %s\n' "${SCRIPT_NAME}" "$*" >&2
+}
+
+fatal() {
+    printf '[%s] FEHLER: %s\n' "${SCRIPT_NAME}" "$*" >&2
+    exit 1
+}
+
+require_root() {
+    if [[ "${EUID}" -ne 0 ]]; then
+        fatal "Das Enrollment-Autorisierungsmodul muss als root ausgeführt werden."
+    fi
+}
+
+prepare_runtime_directory() {
+    install -d \
+        --mode=0700 \
+        --owner=root \
+        --group=root \
+        "${RUNTIME_DIR}"
+
+    rm -f -- "${AUTHORIZATION_FILE}"
+}
+
+store_bootstrap_authorization() {
+    local activation_code
+
+    activation_code="${TUXFLOTTE_ACTIVATION_CODE:-LAB-2026-START}"
+
+    jq \
+        --null-input \
+        --arg activation_code "${activation_code}" \
+        '{
+            schema_version: 1,
+            authorization_type: "bootstrap_activation_code",
+            activation_code: $activation_code
+        }' >"${AUTHORIZATION_FILE}"
+
+    chmod 0600 "${AUTHORIZATION_FILE}"
+}
+
+validate_authorization() {
+    jq --exit-status '
+        .schema_version == 1
+        and .authorization_type == "bootstrap_activation_code"
+        and (.activation_code | type == "string")
+        and (.activation_code | length > 0)
+    ' "${AUTHORIZATION_FILE}" >/dev/null ||
+        fatal "Enrollment-Autorisierung ist ungültig."
+}
+
+main() {
+    require_root
+    prepare_runtime_directory
+    store_bootstrap_authorization
+    validate_authorization
+
+    log "Temporäre Bootstrap-Autorisierung wurde vorbereitet."
+}
+
+main "$@"
diff --git a/scripts/modules/15_server_handshake.sh b/scripts/modules/15_server_handshake.sh
index b87f739..ed8bbd0 100755
--- a/scripts/modules/15_server_handshake.sh
+++ b/scripts/modules/15_server_handshake.sh
@@ -9,7 +9,7 @@ readonly HARDWARE_FILE="/run/tuxflotte/hardware/hardware.json"
 
 readonly RUNTIME_DIR="/run/tuxflotte/server"
 readonly ACTIVATION_FILE="${RUNTIME_DIR}/activation.json"
-
+readonly AUTHORIZATION_FILE="/run/tuxflotte/enrollment/authorization.json"
 readonly RESPONSE_FILE="${RUNTIME_DIR}/response.json"
 
 log() {
@@ -46,6 +46,17 @@ validate_inputs() {
 
     jq --exit-status . "${HARDWARE_FILE}" >/dev/null ||
         fatal "Hardwaredatei enthält kein gültiges JSON."
+
+    [[ -r "${AUTHORIZATION_FILE}" ]] ||
+    fatal "Enrollment-Autorisierung nicht gefunden: ${AUTHORIZATION_FILE}"
+
+    jq --exit-status '
+        .schema_version == 1
+        and .authorization_type == "bootstrap_activation_code"
+        and (.activation_code | type == "string")
+        and (.activation_code | length > 0)
+    ' "${AUTHORIZATION_FILE}" >/dev/null ||
+        fatal "Enrollment-Autorisierung ist ungültig."
 }
 
 build_activation_request() {
@@ -121,7 +132,13 @@ main() {
 
     local activation_code
 
-    activation_code="${TUXFLOTTE_ACTIVATION_CODE:-LAB-2026-START}"
+    local activation_code
+
+    activation_code="$(
+        jq --raw-output \
+            '.activation_code' \
+            "${AUTHORIZATION_FILE}"
+    )"
 
     build_activation_request "${activation_code}" >"${ACTIVATION_FILE}"