#!/usr/bin/env bash

set -Eeuo pipefail

readonly SCRIPT_NAME="${0##*/}"

readonly RUNTIME_DIR="/run/tuxflotte/enrollment"
readonly AUTHORIZATION_FILE="${RUNTIME_DIR}/authorization.json"

log() {
    printf '[%s] %s\n' "${SCRIPT_NAME}" "$*" >&2
}

fatal() {
    printf '[%s] FEHLER: %s\n' "${SCRIPT_NAME}" "$*" >&2
    exit 1
}

require_root() {
    if [[ "${EUID}" -ne 0 ]]; then
        fatal "Das Enrollment-Autorisierungsmodul muss als root ausgeführt werden."
    fi
}

prepare_runtime_directory() {
    install -d \
        --mode=0700 \
        --owner=root \
        --group=root \
        "${RUNTIME_DIR}"

    rm -f -- "${AUTHORIZATION_FILE}"
}

store_bootstrap_authorization() {
    local activation_code

    if [[ -n "${TUXFLOTTE_ACTIVATION_CODE:-}" ]]; then
        activation_code="${TUXFLOTTE_ACTIVATION_CODE}"
    else
        printf '\n'
        read -r -p "Temporären Aktivierungscode eingeben: " activation_code
    fi

    [[ -n "${activation_code}" ]] ||
        fatal "Es wurde kein Aktivierungscode angegeben."

    jq \
        --null-input \
        --arg activation_code "${activation_code}" \
        '{
            schema_version: 1,
            authorization_type: "bootstrap_activation_code",
            activation_code: $activation_code
        }' >"${AUTHORIZATION_FILE}"

    chmod 0600 "${AUTHORIZATION_FILE}"
}

validate_authorization() {
    jq --exit-status '
        .schema_version == 1
        and .authorization_type == "bootstrap_activation_code"
        and (.activation_code | type == "string")
        and (.activation_code | length > 0)
    ' "${AUTHORIZATION_FILE}" >/dev/null ||
        fatal "Enrollment-Autorisierung ist ungültig."
}

main() {
    require_root
    prepare_runtime_directory
    store_bootstrap_authorization
    validate_authorization

    log "Temporäre Bootstrap-Autorisierung wurde vorbereitet."
}

main "$@"