#!/usr/bin/env bash
# =============================================================================
# eBdesk SiCABE — Generate keystore TLS Trino (+ ekspor sertifikat untuk klien)
# =============================================================================
# Mengapa perlu SAN (Subject Alternative Name)?
#   Keystore lama hanya berisi CN=localhost TANPA SAN. Klien yang memverifikasi
#   TLS (bukan mematikannya) tidak dapat memakai sertifikat itu untuk hostname
#   `trino` (nama service di jaringan compose) → verifikasi gagal. Sertifikat di
#   sini menerbitkan SAN: trino, localhost, sicabe-trino, 127.0.0.1 sehingga
#   verifikasi BERJALAN (bukan dimatikan).
#
# Diperlukan oleh:
#   - Trino: /etc/trino/keystore.p12 (password di config.properties)
#   - Klien yang memverifikasi (mis. ingestion OpenMetadata): sertifikat PEM hasil
#     ekspor di config/trino/certs/trino.crt
#
# ⚠️ Ini keystore DEVELOPMENT (di-commit). Untuk produksi: generate ulang, jangan
#    commit private key-nya, dan ganti `http-server.https.keystore.key`.
#
# Usage:
#   ./scripts/generate-trino-keystore.sh
#   TRINO_KEYSTORE_PASSWORD=rahasia ./scripts/generate-trino-keystore.sh
# =============================================================================
set -uo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=../lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"

# Opsi:
#   --out <dir>        tulis <dir>/keystore.p12 + <dir>/certs/trino.crt (default config/trino)
#   --san-extra <csv>  tambahkan entri SAN, mis. "IP:10.0.0.11,IP:10.0.0.12" — dipakai
#                      multi-host supaya klien yang terhubung via ALAMAT HOST tetap
#                      memverifikasi TLS (cert tak hanya valid utk nama container).
OUT_DIR="${SCRIPT_DIR}/config/trino"
SAN_EXTRA=""
while [[ $# -gt 0 ]]; do
  case "$1" in
    --out)       OUT_DIR="${2:-}"; shift 2 ;;
    --san-extra) SAN_EXTRA="${2:-}"; shift 2 ;;
    -h|--help)   sed -n '20,23p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 0 ;;
    *) echo -e "${ERR} Argumen tidak dikenal: $1"; exit 2 ;;
  esac
done

KEYSTORE="${OUT_DIR}/keystore.p12"
CERT_DIR="${OUT_DIR}/certs"
CERT="${CERT_DIR}/trino.crt"
PROPS="${SCRIPT_DIR}/config/trino/config-coordinator.properties"

# Password keystore: env menang, kalau tidak ambil dari config.properties
# (Trino memakai SATU password untuk keystore & key).
KS_PASSWORD="${TRINO_KEYSTORE_PASSWORD:-}"
if [[ -z "${KS_PASSWORD}" ]]; then
  KS_PASSWORD="$(sed -n 's/^http-server.https.keystore.key=//p' "${PROPS}" 2>/dev/null | head -1)"
fi
if [[ -z "${KS_PASSWORD}" ]]; then
  echo -e "${ERR} Password keystore tidak diketahui (isi TRINO_KEYSTORE_PASSWORD)."
  exit 1
fi

SAN="DNS:trino,DNS:localhost,DNS:sicabe-trino,DNS:trino-coordinator,DNS:trino-worker,IP:127.0.0.1"
[[ -n "${SAN_EXTRA}" ]] && SAN="${SAN},${SAN_EXTRA}"
mkdir -p "${CERT_DIR}"
TMP_KEY="$(mktemp)"
trap 'rm -f "${TMP_KEY}"' EXIT

echo -e "${INFO} Menerbitkan sertifikat self-signed (SAN: ${SAN})..."
if ! openssl req -x509 -newkey rsa:2048 -nodes -days 825 \
  -keyout "${TMP_KEY}" -out "${CERT}" \
  -subj "/CN=trino" -addext "subjectAltName=${SAN}" >/dev/null 2>&1; then
  echo -e "${ERR} Gagal membuat sertifikat (openssl tidak tersedia?)."
  exit 1
fi

echo -e "${INFO} Membungkus ke PKCS12 (${KEYSTORE##*/})..."
if ! openssl pkcs12 -export -in "${CERT}" -inkey "${TMP_KEY}" \
  -name trino -out "${KEYSTORE}" -passout "pass:${KS_PASSWORD}" >/dev/null 2>&1; then
  echo -e "${ERR} Gagal membuat keystore PKCS12."
  exit 1
fi
chmod 644 "${KEYSTORE}" "${CERT}"

echo -e "${OK} Keystore dibuat: ${KEYSTORE}"
echo -e "${OK} Sertifikat diekspor: ${CERT}"
openssl x509 -in "${CERT}" -noout -subject -dates 2>/dev/null | sed 's/^/    /'
openssl x509 -in "${CERT}" -noout -ext subjectAltName 2>/dev/null | sed 's/^/    /'
echo -e "${INFO} Restart Trino coordinator agar sertifikat baru dipakai: ./install.sh --restart trino-coordinator"