#!/usr/bin/env bash
#
# Copyright (c) 2024, Cloudera, Inc. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

source "$VAULT_HOME"/bin/utils.sh

# Load vault-specific configuration if available
if [ -n "${VAULT_SERVER_CONF_FILE}" ]; then
  if [ ! -f "${VAULT_SERVER_CONF_FILE}" ]; then
    echo "Could not open ${VAULT_SERVER_CONF_FILE}!"
    exit 1
  fi

  if [ -z "${VAULT_SERVER_PID_FILE}" ]; then
    export VAULT_SERVER_PID_FILE=$(get_properties_conf_value "vault.server.pid.file" ${VAULT_SERVER_CONF_FILE})
  fi
fi

source "$VAULT_HOME"/bin/common.sh  # load commons if needed

#
# Sets up the Vault server.
#
csd_setup_vault_server() {
  echo "Setup the Vault server"
  $VAULT_HOME/bin/vault-server.sh setup
}

#
# Convert the private key from encrypted pkcs8 to encrypted pkcs1 format
#
__csd_convert_encoded_pkcs8_private_key_to_pkcs1() {

  if [ -z "${VAULT_SERVER_SSL_CONF_FILE}" ]; then
    echo "Could not open ${VAULT_SERVER_SSL_CONF_FILE}!"
    exit 1
  fi

  if [ -f "${VAULT_SERVER_SSL_CONF_FILE}" ]; then

    if [ -z "${VAULT_SERVER_TLS_KEY_FILE}" ]; then
      VAULT_SERVER_TLS_KEY_FILE=$(get_properties_conf_value "server.ssl.key.pem" ${VAULT_SERVER_SSL_CONF_FILE})
    fi

    # check if encrypted
    if ! $(grep -q  "ENCRYPTED PRIVATE KEY" "${VAULT_SERVER_TLS_KEY_FILE}"); then
      echo "${VAULT_SERVER_TLS_KEY_FILE} is not encrypted"
      return
    fi

    if [ -z "${VAULT_SERVER_TLS_KEY_PASS}" ]; then
      VAULT_SERVER_TLS_KEY_PASS=$(get_properties_conf_value "server.ssl.key-password" ${VAULT_SERVER_SSL_CONF_FILE})
    fi

    local openssl_major_version=$(get_openssl_version |  awk -F '.' {'print $1'})
    if [ "${openssl_major_version}" -ge 3 ]; then
      OPENSSL_OPTS=-traditional
    fi

    local vault_server_tls_key_file_new="${CONF_DIR}/vault_key.pem"
    openssl rsa -in "${VAULT_SERVER_TLS_KEY_FILE}" -passin pass:"${VAULT_SERVER_TLS_KEY_PASS}" -out "${vault_server_tls_key_file_new}" -passout pass:"${VAULT_SERVER_TLS_KEY_PASS}" -aes256 ${OPENSSL_OPTS}

    echo "Created new private key (${vault_server_tls_key_file_new}) in pem format!"

    vault_server_tls_key_file_new=$(echo $vault_server_tls_key_file_new | sed 's_/_\\/_g')
    set_properties_conf_value "server.ssl.key.pem" "${vault_server_tls_key_file_new}" "${VAULT_SERVER_SSL_CONF_FILE}"

  fi
}

#
# Starts the Vault server.
#
csd_start_vault_server() {
  echo "VAULT_CONF_DIR: $VAULT_CONF_DIR"
  echo "VAULT_SERVER_SSL_CONF_FILE: $VAULT_SERVER_SSL_CONF_FILE"

  if [ "${VAULT_SERVER_TLS}" = true ]; then
    set_properties_conf_value "vault.server.scheme" "https" "${VAULT_SERVER_CONF_FILE}"
    __csd_convert_encoded_pkcs8_private_key_to_pkcs1
  fi

  $VAULT_HOME/bin/configure.sh

  echo "Starting the Vault server.."
  export RUN_IN_BACKGROUND=false
  exec $VAULT_HOME/bin/vault-server.sh start
}

#
# Stops the Vault server.
#
csd_stop_vault_server() {
  echo "VAULT_CONF_DIR: $VAULT_CONF_DIR"

  echo "Stopping the Vault server.."
  $VAULT_HOME/bin/vault-server.sh stop
  EXIT_CODE=$?

  if [ "${EXIT_CODE}" != "0" ]; then
    echo "Failed to stop the Vault server!"
    exit $EXIT_CODE
  else
    echo "Done!"
  fi
}
