#!/usr/bin/env bash
# RiskLink Agent — Enrollment nach Paketinstallation (ohne Bundle-Neu-Download).
set -euo pipefail

API_URL="https://app.risklink.ch/api/v1"
ENROLL_TOKEN=""
INSTALL_CRON="1"
SCHEDULER="cron"

require_command() {
    if ! command -v "$1" >/dev/null 2>&1; then
        echo "Fehlendes Kommando: $1" >&2
        exit 1
    fi
}

while [[ $# -gt 0 ]]; do
    case "$1" in
        --api-url=*) API_URL="${1#*=}"; shift ;;
        --api-url) API_URL="$2"; shift 2 ;;
        --enroll-token=*) ENROLL_TOKEN="${1#*=}"; shift ;;
        --enroll-token) ENROLL_TOKEN="$2"; shift 2 ;;
        --no-cron) INSTALL_CRON="0"; shift ;;
        --scheduler=*) SCHEDULER="${1#*=}"; shift ;;
        --scheduler) SCHEDULER="$2"; shift 2 ;;
        -h | --help)
            cat <<EOF
Verwendung: risklink-agent-enroll --enroll-token=rlenr_… [--api-url=URL] [--scheduler=cron|systemd] [--no-cron]

Registriert den Host bei RiskLink und schreibt /etc/risklink/agent.conf.
Das Agent-Bundle muss bereits installiert sein (Paket risklink-agent).
EOF
            exit 0
            ;;
        *)
            echo "Unbekannte Option: $1" >&2
            exit 1
            ;;
    esac
done

if [[ "$(id -u)" -ne 0 ]]; then
    echo "Enrollment erfordert root (sudo risklink-agent-enroll …)" >&2
    exit 1
fi

if [[ -z "${ENROLL_TOKEN}" ]]; then
    echo "--enroll-token ist erforderlich" >&2
    exit 1
fi

if [[ ! -f /opt/risklink/agent/risklink-agent.sh ]]; then
    echo "Agent-Bundle fehlt unter /opt/risklink/agent (Paket risklink-agent installieren)" >&2
    exit 1
fi

require_command curl
require_command jq

HOSTNAME="$(hostname -f 2>/dev/null || hostname)"
BODY="$(jq -n --arg token "${ENROLL_TOKEN}" --arg host "${HOSTNAME}" '{enrollment_token: $token, hostname: $host, name: $host}')"
RESP="$(curl -fsS -X POST "${API_URL%/}/agent/enroll" -H 'Content-Type: application/json' --data "${BODY}")"
AGENT_TOKEN="$(echo "${RESP}" | jq -r '.data.agent_token')"
CUSTOMER_ID="$(echo "${RESP}" | jq -r '.data.customer_id')"

if [[ -z "${AGENT_TOKEN}" || "${AGENT_TOKEN}" == "null" ]]; then
    echo "Enrollment fehlgeschlagen: ${RESP}" >&2
    exit 1
fi

mkdir -p /etc/risklink /var/lib/risklink
touch /var/log/risklink-agent.log
chmod 640 /var/log/risklink-agent.log 2>/dev/null || true

{
    printf 'RISKLINK_API_URL=%q\n' "${API_URL%/}"
    printf 'RISKLINK_API_TOKEN=%q\n' "${AGENT_TOKEN}"
    printf 'RISKLINK_CUSTOMER_ID=%q\n' "${CUSTOMER_ID}"
    printf 'RISKLINK_LOG_FILE=%q\n' '/var/log/risklink-agent.log'
} > /etc/risklink/agent.conf
chmod 600 /etc/risklink/agent.conf

install -m 0755 /opt/risklink/agent/risklink-agent /usr/local/bin/risklink-agent

if [[ "${INSTALL_CRON}" == "1" ]]; then
    if [[ "${SCHEDULER}" == "systemd" ]]; then
        # shellcheck source=/opt/risklink/agent/lib/install-systemd.sh
        source /opt/risklink/agent/lib/install-systemd.sh
        install_agent_systemd || true
    else
        # shellcheck source=/opt/risklink/agent/lib/install-cron.sh
        source /opt/risklink/agent/lib/install-cron.sh
        install_agent_cron || true
    fi
fi

echo "RiskLink Agent enrolled."
echo "Manuell: risklink-agent"
