#!/usr/bin/env sh

# Convert all templated variables to shell variables
INSTALL_VERSION=${INSTALL_VERSION}
VAULT_ADDR=${VAULT_ADDR}
GITHUB_EXTERNAL_AUTH_ID=${GITHUB_EXTERNAL_AUTH_ID}
AUTH_PATH=${AUTH_PATH}

fetch() {
  dest="$1"
  url="$2"
  if command -v curl > /dev/null 2>&1; then
    curl -sSL --fail "$${url}" -o "$${dest}"
  elif command -v wget > /dev/null 2>&1; then
    wget -O "$${dest}" "$${url}"
  elif command -v busybox > /dev/null 2>&1; then
    busybox wget -O "$${dest}" "$${url}"
  else
    printf "curl, wget, or busybox is not installed. Please install curl or wget in your image.\n"
    exit 1
  fi
}

unzip() {
  if command -v unzip > /dev/null 2>&1; then
    command unzip "$@"
  elif command -v busybox > /dev/null 2>&1; then
    busybox unzip "$@"
  else
    printf "unzip or busybox is not installed. Please install unzip in your image.\n"
    exit 1
  fi
}

# Fetch the latest version of Vault if INSTALL_VERSION is 'latest'
if [ "$${INSTALL_VERSION}" = "latest" ]; then
  LATEST_VERSION=$(curl -s https://releases.hashicorp.com/vault/ | grep -oP 'vault/\K[0-9]+\.[0-9]+\.[0-9]+' | sort -V | tail -n 1)
  printf "Latest version of Vault is %s.\n\n" "$${LATEST_VERSION}"
  # check if the latest version is empty
  if [ "$${LATEST_VERSION}" = "" ]; then
    printf "Failed to determine the latest Vault version.\n"
    exit 1
  fi
  VERSION="$${LATEST_VERSION}"
fi

# Check if the vault CLI is installed and has the correct version
installation_needed=1
if command -v vault > /dev/null 2>&1; then
  CURRENT_VERSION=$(vault version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
  if [ "$${CURRENT_VERSION}" = "$${INSTALL_VERSION}" ]; then
    printf "Vault version %s is already installed and up-to-date.\n\n" "$${CURRENT_VERSION}"
    installation_needed=0
  fi
fi

if [ "$${installation_needed}" = 1 ]; then
  # Download and install Vault
  # if the current version is not the same as the version we want to install
  if [ "$CURRENT_VERSION" = "" ]; then
    printf "Installing Vault CLI ...\n\n"
  else
    printf "Upgrading Vault CLI from version %s to %s ...\n\n" "$${CURRENT_VERSION}" "$${VERSION}"
  fi
  fetch vault.zip "https://releases.hashicorp.com/vault/$${VERSION}/vault_$${VERSION}_linux_amd64.zip"
  if [ $? -ne 0 ]; then
    printf "Failed to download Vault.\n"
    exit 1
  fi
  unzip vault.zip
  if [ $? -ne 0 ]; then
    printf "Failed to unzip Vault.\n"
    exit 1
  fi
  rm vault.zip
  if sudo mv vault /usr/local/bin/vault 2> /dev/null; then
    printf "Vault installed successfully!\n\n"
  else
    mkdir -p ~/.local/bin
    mv vault ~/.local/bin/vault
    if [ ! -f ~/.local/bin/vault ]; then
      printf "Failed to move Vault to local bin.\n"
      exit 1
    fi
    printf "Please add ~/.local/bin to your PATH to use vault CLI.\n"
  fi
fi

# Authenticate with Vault
printf "🔑 Authenticating with Vault ...\n\n"
GITHUB_TOKEN=$(coder external-auth access-token "$${GITHUB_EXTERNAL_AUTH_ID}")
if [ $? -ne 0 ]; then
  printf "Authentication with Vault failed. Please check your credentials.\n"
  exit 1
fi

export VAULT_ADDR="$${VAULT_ADDR}"

# Login to vault using the GitHub token
printf "🔑 Logging in to Vault ...\n\n"
vault login -no-print -method=github -path="/$${AUTH_PATH}" token="$${GITHUB_TOKEN}"
printf "🥳 Vault authentication complete!\n\n"
printf "You can now use Vault CLI to access secrets.\n"
