#!/bin/sh -e
#
# 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
# 2014 Nico Schottelius (nico-cdist at schottelius.org)
# 2021 Darko Poljak (darko.poljak at gmail.com)
#
# This file is part of cdist.
#
# cdist is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# cdist is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with cdist. If not, see <http://www.gnu.org/licenses/>.
#

state="$(cat "$__object/parameter/state" 2>/dev/null)"
file="$(cat "$__object/explorer/file")"
keys_file="$__object/explorer/keys"

temp_file="${file}.tmp"
work_file="${temp_file}.work"

_type_and_key() {
    echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }'
}

_gen_key_entry() {
    _the_key="$1"
    # generate the key entry as it should be
    if [ -f "$__object/parameter/option" ]; then
        # comma seperated list of options
        options="$(tr '\n' ',' < "$__object/parameter/option")"
        printf '%s ' "${options%*,}"
    fi
    if [ -f "$__object/parameter/comment" ]; then
        # extract the keytype and base64 encoded key ignoring any options and comment
        printf '%s ' "$(echo "${_the_key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
        # override the comment with the one explicitly given
        printf '%s' "$(cat "$__object/parameter/comment")"
    else
        printf '%s' "${_the_key}"
    fi
    printf '\n'
}

cat << DONE
cp -f "${file}" "${temp_file}"
DONE

while read -r key; do
    # validate key
    validated_key="$(echo "${key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
    if [ -z "${validated_key}" ]
    then
        echo "Key is invalid: \"${key}\"" >&2
        exit 1
    fi

    type_and_key="$(_type_and_key "${key}")"

    # remove conflicting entries
    cat << DONE
    grep -v "${type_and_key}\\([ \\n].*\\)*\$" "${temp_file}" > "${work_file}" || true
DONE

    entry="$(_gen_key_entry "${key}")"

    case "${state}" in
        present)
            # escape single quotes
            _line_sanitised=$(echo "${entry}" | sed -e "s/'/'\"'\"'/g")
            cat << DONE
            printf "%s\\n" "${_line_sanitised}" >> "${work_file}"
            mv -f "${work_file}" "${temp_file}"
DONE
            echo "added to ${file} (${entry})" >> "$__messages_out"
        ;;
        absent)
            cat << DONE
            grep -v "${entry}" "${work_file}" > "${temp_file}" || true
            rm -f "${work_file}"
DONE
            echo "removed from ${file} (${entry})" >> "$__messages_out"
        ;;
    esac
done < "$__object/parameter/key"

set --
cat << DONE
set --
DONE
if [ -f "$__object/parameter/remove-unknown" ] && [ -s "${keys_file}" ]
then
    while read -r key
    do
        type_and_key="$( _type_and_key "${key}" )"

        if grep -Fq "${type_and_key}" "$__object/parameter/key"
        then
            continue
        fi

        # build grep -e patterns
        set -- "\$@" "-e" "${key}"
        cat << DONE
        set -- "\$@" "-e" "${key}"
DONE
    done < "${keys_file}"

    # if no pattern then nothing to remove
    if [ $# -gt 0 ]
    then
        cat << DONE
        grep -v -F -x "\$@" "${temp_file}" > "${work_file}" || true
        mv -f "${work_file}" "${temp_file}"
DONE
    fi
fi

cat << DONE
mv -f "${temp_file}" "${file}"
DONE