#!/bin/sh

# Copyright (c) 2020 Kimmo Suominen <kim@netbsd.org>
# Copyright (c) 2022–2026 Thomas Voss <mail@thomasvoss.com>
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
# WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
# AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA
# OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
# TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.

# Edit a temporary copy of the doas.conf file and check it for syntax
# errors before installing it as the actual doas.conf file.

set -eu

PATH=/bin:/usr/bin:/usr/local/bin
export PATH

readonly PROG="${0##*/}"

umask 022

DOAS_CONF=@DOAS_CONF@
doas_conf_mode="0600"

if [ $(id -u) -eq 0 ]
then
	EDIT="${VISUAL:-${EDITOR:-vi}}"
else
	EDIT=doasedit
fi

warn()
{
	echo "$PROG: $@" >&2
}

err()
{
	warn "$@"
	exit 1
}

usage()
{
	err "Usage: $PROG [-n] [file]";
}

get_intr()
{
	stty -a | sed -En '
		/^(.* )?intr = / {
			s///
			s/;.*$//
			p
		}'
}

set_trap_rm()
{
	local file files
	files=
	for file in "$@"
	do
		files="$files '$file'"
	done
	[ -n "$files" ] && trap "rm -f $files" EXIT HUP INT TERM
}

noop=0

while getopts n c; do
	case "$c" in
	n) noop=$(($noop + 1)) ;;
	*) usage               ;;
	esac
done
shift $(($OPTIND - 1))

case $# in
0)                ;;
1) DOAS_CONF="$1" ;;
*) usage          ;;
esac

case $noop in
0) noop=false                      ;;
1) noop=true                       ;;
*) noop=true; exec >/dev/null 2>&1 ;;
esac

case "$DOAS_CONF" in
-*)
	err "invalid filename: $DOAS_CONF"
	;;
esac

doas_conf_dir="$(dirname "$DOAS_CONF")"
doas_conf_base="$(basename "$DOAS_CONF")"
DOAS_CONF="$doas_conf_dir/$doas_conf_base"
doas_lock_file="$DOAS_CONF.lock"

[ ! -e "$doas_conf_dir" ] && err "$doas_conf_dir does not exist"
[ ! -d "$doas_conf_dir" ] && err "$doas_conf_dir is not a directory"
[ ! -w "$doas_conf_dir" ] && {
	owner="$(stat -c %U "$doas_conf_dir")"
	err "$doas_conf_dir is not writable"
}

tmp_doas="$(mktemp -t vidoas.XXXXXXXX)" || exit 1
set_trap_rm "$tmp_doas"

# It is important that the ln(1) command fails if the target already
# exists.  Some versions are known to behave like "ln -f" by default
# (removing any existing target).  Adjust PATH to avoid such ln(1)
# implementations.

tmp_test_ln="$(mktemp -t vidoas.XXXXXXXX)"
set_trap_rm "$tmp_doas" "$tmp_test_ln"

ln "$tmp_doas" "$tmp_test_ln" 2>/dev/null &&
	err 'ln(1) is not safe for creating lock files, bailing'

# If a doas.conf file exists, copy it into the temporary file for
# editing.  If none exist, the editor will open with an empty file.

if [ -f "$DOAS_CONF" ]
then
	if [ -r "$DOAS_CONF" ]
	then
		cp "$DOAS_CONF" "$tmp_doas"
	else
		err "$DOAS_CONF is not readable"
	fi
fi

if $noop
then
	doas -C "$DOAS_CONF" || err "$DOAS_CONF contains syntax errors"
	warn 'ok; prerequisite checks passed'
	exit 0
fi

# Link the temporary file to the lock file.

if ln "$tmp_doas" "$doas_lock_file"
then
	set_trap_rm "$tmp_doas" "$tmp_test_ln" "$doas_lock_file"
else
	err "$DOAS_CONF is already locked"
fi

# Some versions of vi(1) exit with a code that reflects the number of
# editing errors made.  This is why we ignore the exit code from the
# editor.

"$EDIT" "$tmp_doas" || true

until doas -C "$tmp_doas"
do
	warn "press enter to edit doas.conf again and fix it,"
	warn "or $(get_intr) to cancel."
	read _
	"$EDIT" "$tmp_doas" || true
done

if [ -s "$tmp_doas" ]
then
	if cmp -s "$tmp_doas" "$DOAS_CONF"
	then
		warn "$DOAS_CONF unchanged"
	else
		install -o root -m "$doas_conf_mode" "$tmp_doas" "$DOAS_CONF" &&
			warn "$DOAS_CONF updated"
	fi
else
	warn "not installing an empty doas.conf file"
	warn "$DOAS_CONF unchanged"
fi