#!/usr/bin/env bash

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

source "$SCRIPT_DIR/config.sh"

if [[ "$EUID" -ne 0 ]]; then
    printf 'ERROR: init_state.sh must run as root.\n' >&2
    exit 1
fi

#
# Persistent environment identity
#

mkdir -p "$LAB_STATE_DIR"
chmod 700 "$LAB_STATE_DIR"

if [[ ! -f "$LAB_IDENTITY_FILE" ]]; then
    web_value="$(openssl rand -hex 3)"
    api_value="$(openssl rand -hex 3)"
    admin_value="$(openssl rand -hex 3)"

    web_token="$(
        python3 "$SCRIPT_DIR/identity.py" pack "$web_value"
    )"

    api_token="$(
        python3 "$SCRIPT_DIR/identity.py" pack "$api_value"
    )"

    admin_token="$(
        python3 "$SCRIPT_DIR/identity.py" pack "$admin_value"
    )"

    cat > "$LAB_IDENTITY_FILE" <<STATE
LAB_WEB_SERVICE_TOKEN="web-$web_token"
LAB_API_SERVICE_TOKEN="api-$api_token"
LAB_ADMIN_SERVICE_TOKEN="adm-$admin_token"
STATE

    chown root:root "$LAB_IDENTITY_FILE"
    chmod 600 "$LAB_IDENTITY_FILE"
fi

#
# Investigation evidence
#

mkdir -p "$LAB_EVIDENCE_DIR"

if [[ ! -f "$LAB_EVIDENCE_LOG" ]]; then
    touch "$LAB_EVIDENCE_LOG"
fi

# Keep the evidence readable by the Codio user and secure grader.
chown codio:codio "$LAB_EVIDENCE_DIR"
chown codio:codio "$LAB_EVIDENCE_LOG"

chmod 700 "$LAB_EVIDENCE_DIR"
chmod 600 "$LAB_EVIDENCE_LOG"