populate

#!/bin/sh

set -e

uid=$(id -u)
gid=1000
username=$(id -u -n)
adminRoleGid=0

ln -sf services-daemon.sh @TARGET@/dcache/share/lib/services.sh

@DCACHE_LOAD_CONFIG@
lib="$(getProperty dcache.paths.share.lib)"
. ${lib}/utils.sh
. ${lib}/database.sh

@TARGET@/bin/ctlcluster stop

cd @TARGET@/dcache

prepend() { # $1 - file to update, $2 - text to add.
    tmp=$(mktemp)
    echo "$2" | cat - "$1" > $tmp && mv $tmp "$1"
}

prepend_layout() { # $1 - text to add.
    prepend "@TARGET@/dcache/etc/layouts/system-test.conf" "$1"
}

add_oidc() {
    # The "oidc-add -a" command currently produces output like:
    #
    #     The following account configurations are currently loaded:
    #     HELMHOLTZ
    #     ESCAPE
    #     WLCG
    #
    # Therefore we must skip the first line.
    #
    # See https://github.com/indigo-dc/oidc-agent/issues/395

    loaded_ops=$(oidc-add -a | tail -n +2 | tr '\n' ' ')

    if [ "$loaded_ops" = "" ]; then
	echo
        echo -n "No OPs currently loaded into oidc-agent.  Try running "
        if [ $(oidc-gen -l|wc -l) -lt 2 ]; then
            echo "`oidc-gen` to register some new OPs."
        else
            echo "'oidc-add' to load some OPs."
        fi
        exit
    fi

    echo "Adding support for OP: $loaded_ops"
    prepend etc/gplazma.conf "auth    optional    oidc"

    for op in $loaded_ops; do
        #  The "2>&1" is a work-around for a bug in oidc-token; see:
        #
        #      https://github.com/indigo-dc/oidc-agent/issues/503
        #
        eval $(oidc-token -c $op 2>&1)

        # REVISIT: we should be able to use OIDC_ISS variable to
        # discover the OP's issuer endpoint.  However, the URL is
        # sometimes wrong.  For details, see:
        #
        #     https://github.com/indigo-dc/oidc-agent/issues/396
        #
        # As a work-around, we use the 'iss' claim from the JWT, which
        # assumes the access token is a JWT.
        iss=$(echo $OIDC_AT | cut -d. -f2 | base64 -d 2>/dev/null | jq -r .iss)

        prepend_layout "gplazma.oidc.provider!$op = $iss"

        # REVISIT: here we assume the access token is a JWT.  More
        # generally, we should contact the user-info endpoint to
        # discover the 'sub' claim.

        sub=$(echo $OIDC_AT | cut -d. -f2 | base64 -d 2>/dev/null | jq -r .sub)

        echo "oidc:${sub}@${op} username:${username} uid:$uid gid:$gid,true" >> "@TARGET@/dcache/etc/multi-mapfile"

        aud_claim=$(echo $OIDC_AT|cut -d. -f2 | base64 -d 2>/dev/null | jq -e -r .aud) \
            && audiences="$audiences $aud_claim"
    done

    if [ "$audiences" != "" ]; then
        prepend_layout "gplazma.oidc.audience-targets = $audiences"
    fi

    echo "username:${username} root:/ home:/" >> "@TARGET@/dcache/etc/omnisession.conf"
}

dn() { # $1 - path to X.509 certificate

    # OpenSSL used to print the subject DN like
    #
    #     subject=/C=DE/O=GermanGrid/OU=DESY/CN=Alexander Paul Millar
    #
    # They changed the format to
    #
    #     subject=C = DE, O = GermanGrid, OU = DESY, CN = Alexander Paul Millar
    #
    # Initially without any backwards compatibility. The following
    # accepts either format and produces output like:
    #
    #     /C=DE/O=GermanGrid/OU=DESY/CN=Alexander Paul Millar
    #
    openssl x509 -in "$1" -subject -noout -nameopt compat | sed 's:subject= *\+/\?:/:;s:, :/:g'
}

if [ ! -f etc/dcache.kpwd ]; then
    if [ -f ~/.globus/dcache-systemtest-usercert.pem ]; then
        DN=$(dn ~/.globus/dcache-systemtest-usercert.pem)
        bin/dcache kpwd dcuseradd -u $uid -g $gid,$adminRoleGid -h / -r / -f / \
            -w read-write -p password -s "$DN" system-test
        bin/dcache kpwd dcmapadd "$DN" system-test
    fi
    if [ -f ~/.globus/usercert.pem ]; then
        DN=$(dn ~/.globus/usercert.pem)
        bin/dcache kpwd dcuseradd -u $uid -g $gid,$adminRoleGid -h / -r / -f / \
            -w read-write -p password -s "$DN" "$username"
        bin/dcache kpwd dcmapadd "$DN" "$username"
    fi

    bin/dcache kpwd dcuseradd -u $uid -g $gid -h / -r /users-root \
            -w read-write -p password usersroot
    bin/dcache kpwd dcuseradd -u $uid -g $gid -h / -r /door-root/users-root \
            -w read-write -p password doorrootusersroot

    echo "version 2.1" > etc/grid-security/storage-authzdb
    if which htpasswd; then
      htpasswd -b -c etc/htpasswd admin dickerelch
      htpasswd -b etc/htpasswd readonly password
      echo "authorize admin read-write 0 0 / / /" >> etc/grid-security/storage-authzdb
      echo "authorize readonly read-only 1 1 / / /" >> etc/grid-security/storage-authzdb
    else
      bin/dcache kpwd dcuseradd -u 0 -g 0 -h / -r / -f / \
                                -w read-write -p dickerelch admin
      bin/dcache kpwd dcuseradd -u 1 -g 1 -h / -r / -f / \
                                -w read-only -p password readonly
    fi
fi

if [ ! -f etc/admin/authorized_keys2 ]; then
    for pubkey in id_rsa.pub id_dsa.pub; do
        if [ -f ~/.ssh/$pubkey ]; then
            awk '{print $1,$2,"admin@localhost"}' ~/.ssh/$pubkey >> etc/admin/authorized_keys2
        fi
    done
fi

createfs() {
    bin/chimera -e - <<EOF
writetag / OSMTemplate "StoreName test"
writetag / sGroup "default"
chmod 555 /

mkdir /tape
writetag /tape sGroup "tape"
writetag /tape RetentionPolicy CUSTODIAL
writetag /tape AccessLatency NEARLINE
chown $uid:$gid /tape

mkdir /disk
writetag /disk sGroup "disk"
chown $uid:$gid /disk

mkdir /replica
writetag /replica sGroup "replica"
chown $uid:$gid /replica
writetag /replica RetentionPolicy CUSTODIAL

mkdir /resilient
writetag /resilient sGroup "resilient"
chown $uid:$gid /resilient
writetag /resilient RetentionPolicy REPLICA
writetag /resilient AccessLatency   ONLINE

mkdir /reserved
writetag /reserved sGroup "reserved"
chown $uid:$gid /reserved

mkdir /public
chmod 777 /public
writetag /public sGroup "public"
chown $uid:$gid /public

mkdir /private
chmod 700 /private
writetag /private sGroup "private"
chown $uid:$gid /private

mkdir /users-root
chmod 777 /users-root
mkdir /users-root/door-root
chmod 777 /users-root/door-root
mkdir /door-root
chmod 777 /door-root
mkdir /door-root/users-root
chmod 777 /door-root/users-root
EOF
}
# Apply liquibase change sets in parallel
pids=""
for domain in $(getProperty dcache.domains); do
    for cell in $(getProperty dcache.domain.cells "$domain"); do
        if hasManagedDatabase "$domain" "$cell" && hasAutoSchema "$domain" "$cell"; then
            liquibase "$domain" "$cell" update &
            pids="$! $pids"
        fi
    done
done
for pid in $pids; do
    wait $pid
done

if [ ! -f var/db/chimera.initialized ]; then
    createfs
    touch var/db/chimera.initialized
fi

if [ ! -f etc/linkgroup.conf ]; then
    cat > etc/linkgroup.conf <<EOF
LinkGroup sm-group
$username
system-test
EOF
fi

if [ -f ~/.globus/dcache-systemtest-hostcert.pem ]; then
    cp ~/.globus/dcache-systemtest-hostcert.pem etc/grid-security/hostcert.pem
    cp ~/.globus/dcache-systemtest-hostkey.pem etc/grid-security/hostkey.pem
    ## WORK-AROUND: we're using assemble maven plugin.  This doesn't allow files to be overwritten.
    ##              As the VCS-supplied CA certificates are copied before the system- and user- trust
    ##              stores and the generated host certificate's CA certificates and VCS-supplied
    ##              CA certificate have the same hash (=> same filename), dCache's trust-store will
    ##              have the VCS-supplied CA certificate.  This means that dCache won't trust the CA
    ##              of its host certificate.  To fix this, we copy the CA certificates manually.
    cp ~/.globus/dcache-systemtest-certificates/* etc/grid-security/certificates
else
    echo
    echo "INFO: using VCS-supplied credentials.  These should work, but Globus native"
    echo "      clients on some platforms will fail.  Use 'hostCredentials --generate'"
    echo "      command to generate a host-specific credential if you have this problem."
fi


compare() {
    rc=0
    cmp -s "$1" "$2" || rc=$?
    if [ $rc -eq 1 ]; then
	echo
	echo "WARNING: files $1 and $2 are different."
	echo "         This difference can cause authentication problems, so should be"
	echo "         resolved."
    fi
}

warn_missing_trust=0
for path in etc/grid-security/certificates/*; do
    file=$(basename $path)

    if [ ! -f ~/.globus/certificates/$file -a ! -f /etc/grid-security/certificates/$file ]; then
        if [ $warn_missing_trust = 0 ]; then
            echo
            echo "WARNING: not all certificates dCache trusts are trusted by YOU.  This can cause"
            echo "         authentication problems when trying to use dCache.  To solve this"
            echo "         problem use the 'hostCredentials --install' command."
            warn_missing_trust=1
        fi
        continue
    fi

    compare $path ~/.globus/certificates/$file
    compare $path /etc/grid-security/certificates/$file
done

command -v oidc-token >/dev/null && add_oidc || :