#!/bin/bash
#final testing of the birth cert to ensure that provisioning has been done successfully
function test_vehicle_cert {
    echo "Testing the provisioned vehicle..."
    # use the birth cert to log into vault. The purpose is to test, at provisioning time, that the birth cert "works" and fail early if it doesn't.
    TEST_KEY=""
    TEST_TOKEN=""
    if [ "$IS_LOCAL" = "true" ]; then
        if [ "$VEHICLE_TPM" = "true" ]; then
            # we read the stored cert and sealed key from the tpm
            # reading birth cert from the tpm
            if ! "$TPM2_NV_READ" "$VEHICLE_TPM2_BIRTH_CERT_INDEX" -o "$TEST_BIRTH_CERT_DER" -C o ; then
                echo "Could not read the stored birth cert from the tpm into $TEST_BIRTH_CERT_DER ."
                echo "Birth cert test was NOT successful."
                exit 1
            fi
            # converting the extracted der cert into pem
            if ! "$VEHICLE_OPENSSL" x509 -inform DER -in "$TEST_BIRTH_CERT_DER" -out "$TEST_BIRTH_CERT_CRT" -text ; then
                echo "Could not convert the temorary test birth cert DER file ($TEST_BIRTH_CERT_DER) into a PEM file ($TEST_BIRTH_CERT_CRT)"
                echo "Birth cert test was NOT successful."
                exit 1
            fi
            # reading birth sealed key from the tpm
            if ! "$TPM2_NV_READ" "$VEHICLE_TPM2_BIRTH_SEALEDKEY_INDEX" -o "$TEST_BIRTH_SEALED_KEY" -C o ; then
                echo "Could not read the stored sealed birth key from the tpm into $TEST_BIRTH_SEALED_KEY ."
                echo "Birth cert test was NOT successful."
                exit 1
            fi
            # use vehicle curl, with the tpm engine, to login to vault
            TEST_CERT="$TEST_BIRTH_CERT_CRT"
            TEST_KEY="$TEST_BIRTH_SEALED_KEY"
            TEST_TOKEN="$(OPENSSL_ENGINES=$TPM2TSS_ENGINE "$VEHICLE_CURL" --request POST --cert "$TEST_CERT" --engine tpm2tss --key-type ENG --key "$TEST_KEY" "$VAULT_ADDR"/v1/auth/cert/login | "$VEHICLE_JQ" --raw-output '.auth.client_token')"
            if [ -z "$TEST_TOKEN" ]; then
                echo "Birth cert test was NOT successful. Either the cert has not been generated successfully, or it has not yet been registered, or the correct birth cert chain has not been installed on the vehicle."
                echo "Contact your administrator for resolving any of these issues."
                exit 1
            else
                echo "Birth cert test (local run, with tpm) was successful. "
            fi

        else
            if [ "$VEHICLE_TPM" = "false" ]; then
                # we read the stored cert and unsealed key from storage directory
                TEST_CERT="$BIRTH_STORE_DIR/$VEHICLE_NAME.crt"
                TEST_KEY="$BIRTH_STORE_DIR/$VEHICLE_NAME.key"
                # use vehicle curl, without the tpm engine, to login to vault
                TEST_TOKEN="$("$VEHICLE_CURL" --request POST --cert "$TEST_CERT" --key "$TEST_KEY" "$VAULT_ADDR"/v1/auth/cert/login | "$VEHICLE_JQ" --raw-output '.auth.client_token')"
                if [ -z "$TEST_TOKEN" ]; then
                    echo "Birth cert test was NOT successful. Either the cert has not been generated successfully, or it has not yet been registered, or the correct birth cert chain has not been installed on the vehicle."
                    echo "Contact your administrator for resolving any of these issues."
                    exit 1
                else
                    echo "Birth cert test (local run, no tpm) was successful. "
                fi
            else
                echo "Invalid value for option '--with-tpm'. Valid values are only 'true' or 'false', case-sensitive and without the single-quotes"
                exit 1
            fi
        fi
    else
        if [ "$IS_LOCAL" = "false" ]; then
            if [ "$VEHICLE_TPM" = "true" ]; then
                # we read the stored cert and sealed key from the tpm
                # reading birth cert from the tpm
                if ! "$OP_SSH" -q "$VEHICLE_USER@$VEHICLE_ADDR" "$TPM2_NV_READ $VEHICLE_TPM2_BIRTH_CERT_INDEX -o $TEST_BIRTH_CERT_DER -C o"; then
                    echo "Could not read the stored birth cert from the tpm into $TEST_BIRTH_CERT_DER ."
                    echo "Birth cert test was NOT successful."
                    exit 1
                fi
                # converting the extracted der cert into pem
                if ! "$OP_SSH" -q "$VEHICLE_USER@$VEHICLE_ADDR" "$VEHICLE_OPENSSL x509 -inform DER -in $TEST_BIRTH_CERT_DER -out $TEST_BIRTH_CERT_CRT -text"; then
                    echo "Could not convert the temorary test birth cert DER file ($TEST_BIRTH_CERT_DER) into a PEM file ($TEST_BIRTH_CERT_CRT)"
                    echo "Birth cert test was NOT successful."
                    exit 1
                fi
                # reading birth sealed key from the tpm
                if ! "$OP_SSH" -q "$VEHICLE_USER@$VEHICLE_ADDR" "$TPM2_NV_READ $VEHICLE_TPM2_BIRTH_SEALEDKEY_INDEX -o $TEST_BIRTH_SEALED_KEY -C o"; then
                    echo "Could not read the stored sealed birth key from the tpm into $TEST_BIRTH_SEALED_KEY ."
                    echo "Birth cert test was NOT successful."
                    exit 1
                fi
                # use vehicle curl, with the tpm engine, to login to vault
                TEST_CERT="$TEST_BIRTH_CERT_CRT"
                TEST_KEY="$TEST_BIRTH_SEALED_KEY"
                TEST_TOKEN="$("$OP_SSH" -q "$VEHICLE_USER@$VEHICLE_ADDR" "OPENSSL_ENGINES=$TPM2TSS_ENGINE $VEHICLE_CURL --request POST --cert $TEST_CERT --engine tpm2tss --key-type ENG --key $TEST_KEY $VAULT_ADDR/v1/auth/cert/login | $VEHICLE_JQ --raw-output '.auth.client_token'")"
                if [ -z "$TEST_TOKEN" ]; then
                    echo "Birth cert test was NOT successful. Either the cert has not been generated successfully, or it has not yet been registered, or the correct birth cert chain has not been installed on the vehicle."
                    echo "Contact your administrator for resolving any of these issues."
                    exit 1
                else
                    echo "Birth cert test (remote run, with tpm) was successful. "
                fi

            else
                if [ "$VEHICLE_TPM" = "false" ]; then
                    # we read the stored cert and unsealed key from storage directory
                    TEST_CERT="$BIRTH_STORE_DIR/$VEHICLE_NAME.crt"
                    TEST_KEY="$BIRTH_STORE_DIR/$VEHICLE_NAME.key"
                    # use vehicle curl over ssh, without the tpm engine in the loop, to login to vault
                    TEST_TOKEN="$("$OP_SSH" -q "$VEHICLE_USER@$VEHICLE_ADDR" "$VEHICLE_CURL --request POST --cert $TEST_CERT --key $TEST_KEY $VAULT_ADDR/v1/auth/cert/login | $VEHICLE_JQ --raw-output '.auth.client_token'")"
                    if [ -z "$TEST_TOKEN" ]; then
                        echo "Birth cert test was NOT successful. Either the cert has not been generated successfully, or it has not yet been registered, or the correct birth cert chain has not been installed on the vehicle."
                        echo "Contact your administrator for resolving any of these issues."
                        exit 1
                    else
                        echo "Birth cert test (remote run, no tpm) was successful. "
                    fi
                else
                    echo "Invalid value for option '--with-tpm'. Valid values are only 'true' or 'false', case-sensitive and without the single-quotes"
                    exit 1
                fi
            fi
        else
            echo "Invalid value for '-l' or '--local' option. Legitimate values are: 'true' or 'false'; case-sensitive and without single-quotes."
            exit 1
        fi
    fi
}
