#!/bin/bash
# postinst script for helix-auth-svc
#
# see: dh_installdeb(1)

set -e
INSTALLPREFIX=/opt/perforce/helix-auth-svc
HOMEDIR=/opt/perforce

# summary of how this script can be called:
#        * <postinst> `configure' <most-recently-configured-version>
#        * <old-postinst> `abort-upgrade' <new version>
#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
#          <new-version>
#        * <postinst> `abort-remove'
#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
#          <failed-install-package> <version> `removing'
#          <conflicting-package> <version>
# for details, see http://www.debian.org/doc/debian-policy/ or
# the debian-policy package

function create_user_group() {
    # create perforce group as needed
    if ! getent group perforce >/dev/null; then
        groupadd --system perforce
    fi

    # create perforce user as needed
    if ! getent passwd perforce >/dev/null; then
        useradd --system --comment 'Perforce Admin' --shell /bin/bash \
                --gid perforce --home-dir "$HOMEDIR" perforce
    fi

    # create home directory and set ownership as needed
    if [ ! -d "$HOMEDIR" ]; then
        mkdir -p "$HOMEDIR"
        chown -R perforce:perforce "$HOMEDIR"
    fi

    # ensure perforce user can write to the installation path
    chown -R perforce:perforce "$INSTALLPREFIX"
}

case "$1" in
    configure)
        if [ ! -f "${INSTALLPREFIX}/.env" ] && [ ! -f "${INSTALLPREFIX}/config.toml" ]; then
            PRINT="print \"LOGGING=${INSTALLPREFIX}/logging.config.cjs\""
            # inject LOGGING if not already set; strip comments and blank lines
            awk "BEGIN {flg=0} /^$/{next} /^#/{next} /^LOGGING=/{flg=1; ${PRINT}; next} {print} END {if(flg==0) ${PRINT}}" ${INSTALLPREFIX}/example.env > ${INSTALLPREFIX}/.env
            # set the user and group for setuid/setgid
            echo 'SVC_USER=perforce' >> ${INSTALLPREFIX}/.env
            echo 'SVC_GROUP=perforce' >> ${INSTALLPREFIX}/.env
        fi
        create_user_group

        # If this fails, it means either systemd is not installed or it does not
        # have privileged access (to the container), in which case we will skip
        # setting up the service unit.
        HAS_SYSTEMD=true
        if ! systemctl list-units >/dev/null 2>&1; then
            HAS_SYSTEMD=false
        fi

        if $HAS_SYSTEMD; then
            cat >/etc/systemd/system/helix-auth.service <<__SERVICE_UNIT__
[Unit]
Description=Helix Authentication Service
After=network.target

[Service]
Type=simple
Restart=always
ExecStart=${INSTALLPREFIX}/bin/node ${INSTALLPREFIX}/bin/www.js
WorkingDirectory=${INSTALLPREFIX}

[Install]
WantedBy=multi-user.target
__SERVICE_UNIT__

            systemctl daemon-reload
            systemctl enable helix-auth.service
            systemctl start helix-auth.service

            cat <<__POST_INSTALL_MSG__

===============================================================================
Package installation complete!
===============================================================================

The Helix Authentication Service is now running via systemd using the service
name 'helix-auth'. Use the command 'sudo systemctl status helix-auth' to get
the status of the service.

To configure the service, edit the .env file in the directory shown below, and
then restart the service: sudo systemctl restart helix-auth

    ${INSTALLPREFIX}

In particular, the settings to be changed are the OIDC and/or SAML settings
for your identity provider. The configure-auth-service.js script may be
helpful for this purpose.

    node ${INSTALLPREFIX}/bin/configure-auth-service.js --help

For assistance, please contact support@perforce.com

__POST_INSTALL_MSG__
        else
                # systemd service unit _not_ installed
            cat <<__POST_INSTALL_MSG__

===============================================================================
Package installation complete!
===============================================================================

The Helix Authentication Service is now installed. To configure the service,
edit the .env file in the directory shown below, and then start the service
by invoking './bin/node ./bin/www.js' from the directory shown below.

    ${INSTALLPREFIX}

In particular, the settings to be changed are the OIDC and/or SAML settings
for your identity provider. The configure-auth-service.js script may be
helpful for this purpose.

    node ${INSTALLPREFIX}/bin/configure-auth-service.js --help

For assistance, please contact support@perforce.com

__POST_INSTALL_MSG__
        fi
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

# dh_installdeb will replace this with shell code automatically
# generated by other debhelper scripts.

#DEBHELPER#

exit 0
