#!/bin/bash

#final testing of the provisioning cert to ensure that it has been done successfully
function test_provisioning_cert {
    echo "Testing the provisioning cert..."
    # use the provisioning cert to log into vault. The purpose is to test, at provisioning time, that the provisioning cert "works" and fail early if it doesn't.
    TEST_KEY=""
    TEST_TOKEN=""
    if [ "$OP_TPM" = "true" ]; then
        # we read the stored cert and sealed key from the tpm
        # reading provisioning cert from the tpm
        if ! "$TPM2_NV_READ" "$OP_TPM2_PROVISIONING_CERT_INDEX" -o "$TEST_PROVISIONING_CERT_DER" -C o ; then
            echo "Could not read the stored provisioning cert from the tpm into $TEST_PROVISIONING_CERT_DER ."
            echo "Provisioning cert test was NOT successful."
            exit 1
        fi
        # converting the extracted der cert into pem
        if ! "$OP_OPENSSL" x509 -inform DER -in "$TEST_PROVISIONING_CERT_DER" -out "$TEST_PROVISIONING_CERT_CRT" -text ; then
            echo "Could not convert the temorary test provisioning cert DER file ($TEST_PROVISIONING_CERT_DER) into a PEM file ($TEST_PROVISIONING_CERT_CRT)"
            echo "Provisioning cert test was NOT successful."
            exit 1
        fi
        # reading sealed provisioning key from the tpm
        if ! "$TPM2_NV_READ" "$OP_TPM2_PROVISIONING_SEALEDKEY_INDEX" -o "$TEST_PROVISIONING_SEALED_KEY" -C o ; then
            echo "Could not read the stored sealed provisioning key from the tpm into $TEST_PROVISIONING_SEALED_KEY ."
            echo "Provisioning cert test was NOT successful."
            exit 1
        fi
        # use curl, with the tpm engine, to login to vault
        TEST_CERT="$TEST_PROVISIONING_CERT_CRT"
        TEST_KEY="$TEST_PROVISIONING_SEALED_KEY"
        TEST_TOKEN="$(OPENSSL_ENGINES=$TPM2TSS_ENGINE "$OP_CURL" --request POST --cert "$TEST_CERT" --engine tpm2tss --key-type ENG --key "$TEST_KEY" "$VAULT_ADDR"/v1/auth/cert/login | "$OP_JQ" --raw-output '.auth.client_token')"
        if [ -z "$TEST_TOKEN" ]; then
            echo "Provisioning cert test was NOT successful. Either the cert has not been generated successfully, or it has not yet been registered, or the correct provisioning cert chain has not been installed on the provisioner."
            echo "Contact your administrator for resolving any of these issues."
            exit 1
        else
            echo "Provisioning cert test was successful. "
        fi

    else
        if [ "$OP_TPM" = "false" ]; then
            # we read the stored cert and unsealed key from storage directory
            TEST_CERT="$CERT_STORE_DIR/$OP_NAME.crt"
            TEST_KEY="$CERT_STORE_DIR/$OP_NAME.key"
            # use curl, without the tpm engine, to login to vault
            TEST_TOKEN="$("$OP_CURL" --request POST --cert "$TEST_CERT" --key "$TEST_KEY" "$VAULT_ADDR"/v1/auth/cert/login | "$OP_JQ" --raw-output '.auth.client_token')"
            if [ -z "$TEST_TOKEN" ]; then
                echo "Provisioning cert test was NOT successful. Either the cert has not been generated successfully, or it has not yet been registered, or the correct provisioning cert chain has not been installed on the provisioner."
                echo "Contact your administrator for resolving any of these issues."
                exit 1
            else
                echo "Provisioning cert test was successful. "
            fi
        else
            echo "Invalid value for option '--with-op-tpm'. Valid values are only 'true' or 'false', case-sensitive and without the single-quotes"
            exit 1
        fi
    fi
}
