#!/bin/bash

#Declare the number of mandatory args: vehicle_name, op_cert, op_key are required
NUM_MANDATORY_ARGS=4

function example {
    echo -e "example: remotely provision a vehicle (no tpm on provisioner, no tpm on vehicle):\n  $SCRIPT_NAME --cert OPERATOR_CERT --key OPERATOR_KEY --operator OPERATOR_NAME --vehicle-name VEHICLE_NAME --with-vehicle-tpm false --local false --vehicle-addr VEHICLE_ADDR --vehicle-user VEHICLE_USER"
}

function usage {
    echo -e "usage: $SCRIPT_NAME MANDATORY [OPTION]\n"
}

function help {
  usage
    echo -e "MANDATORY:"
    echo -e "  -n, --vehicle-name       NAME            Common name of the vehicle."
    echo -e "  -o, --operator           OP_NAME         Operator Name with appropriate policies in Vault"
    echo -e "  -c, --cert               OP_CERT         Operator certificate allowing it to get Vault Access Token and/or register birth certificates"
    echo -e "  -k, --key                OP_KEY          Operator key, associated with the operator certificate"
    echo -e "OPTION:"
    echo -e "  -a, --vehicle-addr       VEHICLE_ADDR    Network address of the vehicle. If empty, assumes a local run (equivalent to using '--local true')"
    echo -e "  -v, --vault              VAULT_ADDR      Address of the signer [default: https://vault-rsi.zooxlabs.com:8200]"
    echo -e "  -t, --token              TOKEN           Vault access token used for birth cert generation. If not provided, the tool will attempt to get a token from Vault [default: empty string]"
    echo -e "  -b, --has-one-time-token HAS_1TIME_TOKEN Explicitly indicates the token is good for one use (true/false), as a safety measure. One-time tokens do not require mutual authentication with Vault to generate the birth cert. Note that you would still need a cert and key to register the generated cert [default: false]."
    echo -e "  -u, --vehicle-user       VEHICLE_USER    Vehicle user. The provisioner Should be able to run key-based, passwordless SSH to the vehicle with this username [default: zoox]"
    echo -e "  -w, --with-op-tpm        OP_TPM          Provisioner's key KEY is stored on a TPM chip (true/false) [default: false]"
    echo -e "  -p, --with-vehicle-tpm   VEHICLE_TPM     Utilize the TPM chip on the vehicle to generate & store the birth certificate and sealed key (true/false) [default: true]"
    echo -e "  -l, --local              IS_LOCAL        Indicates that the script is requesting the birth cert directly from the vehicle (true/false) [default: false]. Bypasses operator or the provisioning station for birth cert generation. Requires special one-time TOKEN. You should register the generated birth cert separately, if you indicate a local run with this option."
    echo -e "  -h, --help                               Prints this help\n"
  example
}

# Ensures that the number of passed args are at least equal
# to the declared number of mandatory args.
# It also handles the special case of the -h or --help arg.
function mandatory_args_precheck {
    if [ "$2" ] && [ "$1" -lt "$NUM_MANDATORY_ARGS" ]; then
        if [ "$2" == "--help" ] || [ "$2" == "-h" ]; then
            help
            exit
        else
            usage
            example
            exit 1
        fi
    fi
}

# Ensures that all the mandatory args are not empty
function mandatory_args_check {
    if [ $# -lt "$NUM_MANDATORY_ARGS" ]; then
	usage
	example
	exit 1
    fi
}

mandatory_args_precheck $# "$1"

# Args while-loop
while (( "$#" ));
do
    case $1 in
        -n  | --vehicle-name )
            shift
            VEHICLE_NAME=$1
            ;;
        -a  | --vehicle-addr )
            shift
            VEHICLE_ADDR=$1
            ;;
        -v  | --vault )
            shift
            VAULT_ADDR=$1
            ;;
        -c | --cert )
            shift
            OP_CERT=$1
            ;;
        -k | --key )
            shift
            OP_KEY=$1
            ;;
        -o | --operator )
            shift
            OP_NAME=$1
            ;;
        -t | --token )
            shift
            VAULT_TOKEN=$1
            ;;
        -b | --has-one-time-token )
            shift
            USING_ONE_TIME_TOKEN=$1
            ;;
        -u | --vehicle-user )
            shift
            VEHICLE_USER=$1
            ;;
        -w | --with-op-tpm )
            shift
            OP_TPM=$1
            ;;
        -p | --with-vehicle-tpm )
            shift
            VEHICLE_TPM=$1
            ;;
        -l | --local )
            shift
            IS_LOCAL=$1
            ;;
        -h   | --help )
            help
            exit
            ;;
        *)
            echo "$SCRIPT_NAME: illegal option $1"
            usage
            example
            exit 1 # error
            ;;
    esac
    shift
done

# Add list of mandatory arguments here.
mandatory_args_check "$VEHICLE_NAME" "$OP_NAME" "$OP_CERT" "$OP_KEY"
