#!/bin/bash
# verify-p12 - Verify WebDAV cartridge access with Bearer or Basic auth (optionally mTLS)
#
# Usage:
#   verify-p12 <hostname> <token> [p12_password] [p12_file]
#   verify-p12 -b|--basic <hostname> <user:pass> [p12_password] [p12_file]
#   verify-p12 -h
#
# Options:
#   -b, --basic     Use Basic auth instead of Bearer
#   hostname        Instance hostname (e.g. dev01-web-example.demandware.net)
#   token           Bearer token for authorization (default auth mode)
#   user:pass       Username and password for Basic auth (with --basic)
#   p12_password    (optional) Password for the .p12 client certificate
#   p12_file        (optional) Path to .p12 file (default: $USER-hostname.p12)
#   -h, --help      Show help message

_verify_p12() (
    local SCRIPT_NAME; SCRIPT_NAME="$(basename "${BASH_SOURCE[0]}")"
    case "${BASH_SOURCE[0]}" in /dev/*|/proc/*) SCRIPT_NAME="" ;; esac
    case "$SCRIPT_NAME" in ""|bash|sh|zsh|dash) SCRIPT_NAME="verify-p12" ;; esac

    _error() { echo "[ERR][$SCRIPT_NAME] $*" >&2; }

    _expand_short_opts() {
        # $1 = string of short-opt letters that take a value (e.g. "nXHd"); "" for flag-only scripts
        # $2..$N = "$@"
        # Populates _EXPANDED; caller does: set -- "${_EXPANDED[@]}"; unset _EXPANDED
        local value_opts="$1"; shift
        _EXPANDED=()
        local passthru=""
        local arg
        local rest
        local c
        for arg in "$@"; do
            if [ -n "$passthru" ]; then _EXPANDED+=("$arg"); continue; fi
            case "$arg" in
                --)       passthru=1; _EXPANDED+=("$arg") ;;
                --*|-|"") _EXPANDED+=("$arg") ;;
                -[a-zA-Z]?*)
                    rest="${arg#-}"
                    while [ -n "$rest" ]; do
                        c="${rest%"${rest#?}"}"; rest="${rest#?}"
                        _EXPANDED+=("-$c")
                        case "$value_opts" in *"$c"*)
                            [ -n "$rest" ] && _EXPANDED+=("$rest")
                            rest="" ;;
                        esac
                    done ;;
                *)        _EXPANDED+=("$arg") ;;
            esac
        done
    }

    _show_help() {
        local s; [ -t 1 ] && s=$'\033[4m'
        local r; [ -t 1 ] && r=$'\033[24m'
        cat <<EOF
NAME
  $SCRIPT_NAME - verify WebDAV cartridge access with Bearer or Basic auth
SYNOPSIS
  $SCRIPT_NAME ${s}hostname${r} ${s}token${r} [${s}p12_password${r}] [${s}p12_file${r}]
  $SCRIPT_NAME -b|--basic ${s}hostname${r} ${s}user:pass${r} [${s}p12_password${r}] [${s}p12_file${r}]
  $SCRIPT_NAME -h
DESCRIPTION
  Sends a GET request to /webdav/Sites/Cartridges on ${s}hostname${r}.
  Prints the HTTP status line and cartridge directory listing.

  Default auth is Bearer using the given ${s}token${r}. With --basic,
  auth is Basic using ${s}user:pass${r} (the full colon-delimited string).

  When ${s}p12_password${r} is provided, adds mTLS client certificate
  authentication using the .p12 file. Default ${s}p12_file${r} is
  \$USER-${s}hostname${r}.p12 in the current directory.
OPTIONS
  -b, --basic    Use Basic auth instead of Bearer
  ${s}hostname${r}       Instance hostname (e.g. dev01-web-example.demandware.net)
  ${s}token${r}          Bearer token for authorization (default auth mode)
  ${s}user:pass${r}      Username and password for Basic auth (with --basic)
  ${s}p12_password${r}   (optional) Password for the .p12 client certificate
  ${s}p12_file${r}       (optional) Path to .p12 file (default: \$USER-hostname.p12)
  -h, --help     Show this help message
PRECONDITIONS
  - If ${s}p12_password${r} is given, the .p12 file must exist and be readable
  - Network must be able to reach ${s}hostname${r} on port 443
  - Credentials (token or user:pass, and .p12 password if used) must be valid
EXIT STATUS
  0   curl succeeded (check HTTP status line -- 401/403 still exit 0)
  2   Usage error (missing required argument)
  *   curl exit code on network or TLS failure

  Common curl codes: 35 = TLS handshake, 51 = server cert, 58 = .p12 /
  client-cert problem, 60 = CA cert.
CAVEATS
  curl exit 58 typically means the .p12 file is missing, unreadable, or
  the password is wrong.
DEPENDENCIES
  curl (always); openssl (only with --basic)
SEE ALSO
  propfind-p12, generate-p12
EOF
    }

    local auth_mode="bearer"
    local positional=()

    _expand_short_opts "" "$@"
    set -- "${_EXPANDED[@]}"; unset _EXPANDED

    while [ $# -gt 0 ]; do
        case "$1" in
            -h|--help) _show_help; return 0 ;;
            -b|--basic) auth_mode="basic"; shift ;;
            *) positional+=("$1"); shift ;;
        esac
    done

    if [ "${#positional[@]}" -lt 1 ]; then
        _error "hostname is required. Run \`$SCRIPT_NAME -h\` for usage"
        return 2
    fi
    if [ "${#positional[@]}" -lt 2 ]; then
        _error "credential is required (token, or user:pass with --basic). Run \`$SCRIPT_NAME -h\` for usage"
        return 2
    fi

    local hostname="${positional[0]}"
    local credential="${positional[1]}"
    local p12_pass="${positional[2]-}"
    local p12_arg4="${positional[3]-}"
    local DEFAULT_P12_FILE="$USER-$hostname.p12"

    local auth_header
    case "$auth_mode" in
        bearer)
            auth_header="Authorization: Bearer $credential"
            ;;
        basic)
            local encoded; encoded="$(printf %s "$credential" | openssl enc -base64 -A)"
            auth_header="Authorization: Basic $encoded"
            ;;
    esac

    local p12_args=()
    if [ "$p12_pass" ]; then
        local p12_file="${p12_arg4:-"$DEFAULT_P12_FILE"}"
        # -k (--insecure) disables curl's TLS CA check, otherwise we need to pass --cacert "$ca_cert"
        # This does NOT disable TLS, it simply allows a self-signed certificate without needing to provide the CA cert
        p12_args=("-k" "--cert-type" "p12" "--cert" "$p12_file:$p12_pass")
    fi

    local url="https://$hostname/on/demandware.servlet/webdav/Sites/Cartridges"
    # Print request URL to stderr
    echo "GET $url" >&2
    # Print the HTTP status line and file URLs
    # -i == include response headers in output
    curl -si -X GET \
        --url "$url" \
        -H "$auth_header" \
        "${p12_args[@]}" \
    | tr -d '\r' \
    | grep -e '^HTTP/[.0-9]\{1,3\} [0-9]\{3\} [ A-Za-z]*$' \
           -e '<a href="' \
    | sed 's|^.*<a href="/on/demandware.servlet||; s|">.*$||'
)

_verify_p12 "$@"
__verify_p12_rc=$?
unset -f _verify_p12
if [ -n "${BASH_SOURCE[0]}" ] && [ "${BASH_SOURCE[0]}" != "$0" ]; then
    eval "unset __verify_p12_rc; return $__verify_p12_rc"
fi
eval "unset __verify_p12_rc; exit $__verify_p12_rc"