#!/bin/bash
################################################################################
# Script Name: version/2.1.23/UPDATE.sh
# Description: Turn on the SSL/TLS section on servers that already exist.
# Company: hitechcloud.org
# Copyright (c) hitechcloud.org
################################################################################
#
# The section is four features (ssl_generate, ssl_install, ssl_hosts,
# ssl_storage) inside one module (ssl_tools). A fresh install gets them from
# INSTALL.sh; a server that already exists has neither, so without this the
# pages ship and nobody can reach them - the module is off, and no plan grants
# the features.
#
# Existing per-plan feature sets are left alone except to add these four. An
# operator who has taken a feature away from a plan meant it, and this must not
# quietly hand it back.
################################################################################

set -uo pipefail

GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
ok()   { echo -e "[2.1.23] ${GREEN}✓${NC} $*"; }
warn() { echo -e "[2.1.23] ${YELLOW}!${NC} $*" >&2; }

[[ $EUID -eq 0 ]] || { echo "[2.1.23] This update must run as root." >&2; exit 1; }

readonly CONFIG=/etc/hitechcloud/hitechcloud/conf/hitechcloud.config
readonly FEATURES_DIR=/etc/hitechcloud/hitechcloud/features
readonly MODULES=(ssl_tools ssl_generate ssl_install ssl_hosts ssl_storage)

# 1. The module list the panel reads to decide which routes to register.
if [[ -f "$CONFIG" ]]; then
    current=$(grep -E '^enabled_modules=' "$CONFIG" | head -1 | cut -d= -f2- | tr -d '"')
    added=""
    for module in "${MODULES[@]}"; do
        grep -qE "(^|,)${module}(,|$)" <<< "$current" && continue
        current="${current},${module}"
        added="${added} ${module}"
    done
    if [[ -n "$added" ]]; then
        # Written with a temporary file rather than sed -i on a line that can
        # be two kilobytes long and contain characters sed would read as its
        # own delimiter.
        awk -v line="enabled_modules=\"${current}\"" \
            '/^enabled_modules=/ { print line; next } { print }' "$CONFIG" > "${CONFIG}.new" &&
            cat "${CONFIG}.new" > "$CONFIG" && rm -f "${CONFIG}.new"
        ok "Modules enabled:${added}"
    fi
fi

# 2. The feature sets. Every plan that already grants "ssl" gets the four that
#    belong beside it; a plan that does not grant SSL at all is left alone,
#    because somebody decided that.
granted=0
if [[ -d "$FEATURES_DIR" ]]; then
    for set in "$FEATURES_DIR"/*.txt; do
        [[ -f "$set" ]] || continue
        grep -qx 'ssl' "$set" || continue
        for feature in ssl_generate ssl_hosts ssl_install ssl_storage; do
            grep -qx "$feature" "$set" && continue
            echo "$feature" >> "$set"
            granted=$((granted + 1))
        done
    done
fi
(( granted == 0 )) || ok "Added ${granted} SSL/TLS permission(s) to the plans that already offer SSL"

# The panel remembers each account's feature list for a day; without this the
# section is live and invisible until that expires.
hitechcloudcli cache-forget_features >/dev/null 2>&1 || warn "Could not clear the feature cache - run: hitechcloudcli cache-forget_features"

ok "2.1.23 update complete"
exit 0