#!/usr/bin/env bash
#
# ca_manager.sh - Local host certificate authority helper.
#

set -euo pipefail

CA_DIR="${HOST_MANAGER_CA_DIR:-/usr/local/xdev-host-manager/var/ca}"
OPENSSL="${OPENSSL:-openssl}"
DEFAULT_SUBJECT="/O=Xdev/OU=Madagascar/CN=Xdev Madagascar Local Host CA"
DEFAULT_DAYS=3650
HOST_CERT_DAYS=825

usage() {
    cat <<EOF
Usage:
  $0 init [subject]
  $0 status-json
  $0 list-json
  $0 export-ca
  $0 sign-csr name csr-file dns-name [dns-name...]

Notes:
  - Run init/sign-csr as root.
  - CA private key is stored outside git in \$HOST_MANAGER_CA_DIR/private.
  - The web app only reads status, issued cert metadata, and the public CA cert.
EOF
}

die() {
    printf '[ERROR] %s\n' "$*" >&2
    exit 1
}

need_openssl() {
    command -v "$OPENSSL" >/dev/null 2>&1 || die "openssl not found"
}

json_escape() {
    perl -Mstrict -Mwarnings -e '
        my $s = join("", <>);
        $s =~ s/\\/\\\\/g;
        $s =~ s/"/\\"/g;
        $s =~ s/\n/\\n/g;
        $s =~ s/\r/\\r/g;
        $s =~ s/\t/\\t/g;
        print qq{"$s"};
    ' <<< "${1:-}"
}

safe_name() {
    local name="${1:-}"
    [[ "$name" =~ ^[A-Za-z0-9_.-]+$ ]] || die "unsafe name: $name"
    printf '%s' "$name"
}

ca_cert="$CA_DIR/certs/ca.cert.pem"
ca_key="$CA_DIR/private/ca.key.pem"
serial_file="$CA_DIR/serial.srl"

init_ca() {
    need_openssl
    local subject="${1:-$DEFAULT_SUBJECT}"
    [[ ! -e "$ca_key" ]] || die "CA key already exists: $ca_key"

    install -d -m 0755 "$CA_DIR" "$CA_DIR/certs" "$CA_DIR/csr" "$CA_DIR/issued" "$CA_DIR/requests"
    install -d -m 0700 "$CA_DIR/private"

    "$OPENSSL" genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "$ca_key"
    chmod 0600 "$ca_key"

    "$OPENSSL" req -new -x509 -days "$DEFAULT_DAYS" -sha256 \
        -key "$ca_key" \
        -out "$ca_cert" \
        -subj "$subject" \
        -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
        -addext "keyUsage=critical,keyCertSign,cRLSign" \
        -addext "subjectKeyIdentifier=hash"

    chmod 0644 "$ca_cert"
    chown -R root:host-manager "$CA_DIR" 2>/dev/null || true
    chown root:root "$ca_key" 2>/dev/null || true
    chmod 0600 "$ca_key"
}

cert_field() {
    local cert="$1"
    local field="$2"
    case "$field" in
        subject) "$OPENSSL" x509 -in "$cert" -noout -subject | sed 's/^subject=//' ;;
        issuer) "$OPENSSL" x509 -in "$cert" -noout -issuer | sed 's/^issuer=//' ;;
        not_before) "$OPENSSL" x509 -in "$cert" -noout -startdate | sed 's/^notBefore=//' ;;
        not_after) "$OPENSSL" x509 -in "$cert" -noout -enddate | sed 's/^notAfter=//' ;;
        fingerprint) "$OPENSSL" x509 -in "$cert" -noout -fingerprint -sha256 | sed 's/^sha256 Fingerprint=//' ;;
        serial) "$OPENSSL" x509 -in "$cert" -noout -serial | sed 's/^serial=//' ;;
        *) return 1 ;;
    esac
}

status_json() {
    need_openssl
    if [[ ! -f "$ca_cert" ]]; then
        printf '{"initialized":false,"ca_dir":'
        json_escape "$CA_DIR"
        printf ',"certificates":0}\n'
        return
    fi

    local count=0
    shopt -s nullglob
    local cert
    for cert in "$CA_DIR"/issued/*.cert.pem; do
        count=$((count + 1))
    done
    shopt -u nullglob

    printf '{"initialized":true'
    printf ',"ca_dir":'; json_escape "$CA_DIR"
    printf ',"subject":'; json_escape "$(cert_field "$ca_cert" subject)"
    printf ',"not_before":'; json_escape "$(cert_field "$ca_cert" not_before)"
    printf ',"not_after":'; json_escape "$(cert_field "$ca_cert" not_after)"
    printf ',"fingerprint_sha256":'; json_escape "$(cert_field "$ca_cert" fingerprint)"
    printf ',"certificates":%s' "$count"
    printf '}\n'
}

list_json() {
    need_openssl
    printf '['
    local first=1 cert name
    shopt -s nullglob
    for cert in "$CA_DIR"/issued/*.cert.pem; do
        name="$(basename "$cert" .cert.pem)"
        if [[ "$first" -eq 0 ]]; then
            printf ','
        fi
        first=0
        printf '{"name":'; json_escape "$name"
        printf ',"subject":'; json_escape "$(cert_field "$cert" subject)"
        printf ',"issuer":'; json_escape "$(cert_field "$cert" issuer)"
        printf ',"serial":'; json_escape "$(cert_field "$cert" serial)"
        printf ',"not_before":'; json_escape "$(cert_field "$cert" not_before)"
        printf ',"not_after":'; json_escape "$(cert_field "$cert" not_after)"
        printf ',"fingerprint_sha256":'; json_escape "$(cert_field "$cert" fingerprint)"
        printf '}'
    done
    shopt -u nullglob
    printf ']\n'
}

export_ca() {
    [[ -f "$ca_cert" ]] || die "CA is not initialized"
    cat "$ca_cert"
}

sign_csr() {
    need_openssl
    [[ -f "$ca_key" && -f "$ca_cert" ]] || die "CA is not initialized"
    local name csr days ext cert
    name="$(safe_name "${1:-}")"
    csr="${2:-}"
    shift 2 || true
    [[ -f "$csr" ]] || die "missing CSR file: $csr"
    [[ "$#" -ge 1 ]] || die "at least one DNS SAN is required"

    cert="$CA_DIR/issued/$name.cert.pem"
    [[ ! -e "$cert" ]] || die "certificate already exists: $cert"
    ext="$(mktemp)"
    {
        printf 'basicConstraints=critical,CA:FALSE\n'
        printf 'keyUsage=critical,digitalSignature,keyEncipherment\n'
        printf 'extendedKeyUsage=serverAuth,clientAuth\n'
        printf 'subjectAltName='
        local first=1 dns
        for dns in "$@"; do
            [[ "$dns" =~ ^[A-Za-z0-9_.-]+$ ]] || die "unsafe DNS SAN: $dns"
            if [[ "$first" -eq 0 ]]; then
                printf ','
            fi
            first=0
            printf 'DNS:%s' "$dns"
        done
        printf '\n'
    } > "$ext"

    cp "$csr" "$CA_DIR/csr/$name.csr.pem"
    "$OPENSSL" x509 -req -sha256 \
        -in "$csr" \
        -CA "$ca_cert" \
        -CAkey "$ca_key" \
        -CAserial "$serial_file" \
        -CAcreateserial \
        -days "$HOST_CERT_DAYS" \
        -extfile "$ext" \
        -out "$cert"
    rm -f "$ext"
    chmod 0644 "$cert" "$CA_DIR/csr/$name.csr.pem"
    chown root:host-manager "$cert" "$CA_DIR/csr/$name.csr.pem" 2>/dev/null || true
    printf '%s\n' "$cert"
}

cmd="${1:-}"
case "$cmd" in
    init) shift; init_ca "$@" ;;
    status-json) status_json ;;
    list-json) list_json ;;
    export-ca) export_ca ;;
    sign-csr) shift; sign_csr "$@" ;;
    -h|--help|help|'') usage ;;
    *) die "unknown command: $cmd" ;;
esac