#!/bin/bash
# info: Enable / Disable API access
# options: STATUS [VERSION]
#
# example: v-change-sys-api enable all
#          # Enable both APIs
# example: v-change-sys-api enable
#          # The same thing: VERSION defaults to 'all'
# example: v-change-sys-api enable legacy
#          # Enable legacy api currently default on most of api based systems
# example: v-change-sys-api enable api
#          # Enable api
#
# example: v-change-sys-api disable
#          # Disable API
#
# Enabled / Disable API

status=$1
# VERSION is optional. It used to fall through to setting neither API nor
# API_SYSTEM, so "v-change-sys-api enable" installed the endpoint, uncommented
# its die(), seeded the allow list - and left the API itself off, with nothing
# said about it. It now means 'all', which is the only reading under which the
# command does what its own name says. 'legacy' and 'api' are unchanged: each
# turns on exactly the one it names and leaves the other as it found it.
version="${2:-all}"

# Includes
# shellcheck source=/etc/tuliocp/tulio.conf
source /etc/tuliocp/tulio.conf
# shellcheck source=/usr/local/tulio/func/main.sh
source $TULIO/func/main.sh
# load config file
source_conf "$TULIO/conf/tulio.conf"

#----------------------------------------------------------#
#                Variables & Functions                     #
#----------------------------------------------------------#

check_args '1' "$#" 'STATUS [VERSION]'
is_type_valid "enable,disable,remove" "$status"
if [ "$status" = "enable" ]; then
	is_type_valid "legacy,api,all" "$version"
fi
# Perform verification if read-only mode is enabled
check_tulio_demo_mode

#----------------------------------------------------------#
#                       Action                             #
#----------------------------------------------------------#

if [ "$status" = "enable" ]; then
	if [ ! -f "$TULIO/web/api/index.php" ]; then
		wget -q https://raw.githubusercontent.com/marcosfermin/tuliocp/$RELEASE_BRANCH/web/api/index.php -O $TULIO/web/api/index.php
		if [ ! -s "$TULIO/web/api/index.php" ]; then
			wget -q https://raw.githubusercontent.com/marcosfermin/tuliocp/release/web/api/index.php -O $TULIO/web/api/index.php
			if [ ! -s "$TULIO/web/api/index.php" ]; then
				# Throw error message to user
				echo "ERROR: API installation failed."
				# Remove empty file created by wget output
				rm -f "$TULIO/web/api/index.php"
				exit 1
			fi
		fi
	else
		sed -i 's|die("Error: Disabled");|//die("Error: Disabled");|g' $TULIO/web/api/index.php
		sed -i 's|////|//|g' $TULIO/web/api/index.php
	fi
	# Start from a loopback-only allow list. Reaching the API from anywhere else
	# has to be granted deliberately with v-add-sys-api-ip.
	if [ -z "$API_ALLOWED_IP" ]; then
		$BIN/v-change-sys-config-value "API_ALLOWED_IP" "127.0.0.1"
		check_result $? "unable to set API_ALLOWED_IP" "$E_UPDATE"
	fi
	if [ "$version" = "legacy" ] || [ "$version" = "all" ]; then
		$BIN/v-change-sys-config-value "API" "yes"
		check_result $? "unable to set API" "$E_UPDATE"
	fi
	if [ "$version" = "api" ] || [ "$version" = "all" ]; then
		$BIN/v-change-sys-config-value "API_SYSTEM" "1"
		check_result $? "unable to set API_SYSTEM" "$E_UPDATE"
	fi
else
	$BIN/v-change-sys-config-value "API" "no"
	check_result $? "unable to set API" "$E_UPDATE"
	$BIN/v-change-sys-config-value "API_ALLOWED_IP" ""
	check_result $? "unable to clear API_ALLOWED_IP" "$E_UPDATE"
	$BIN/v-change-sys-config-value "API_SYSTEM" "0"
	check_result $? "unable to set API_SYSTEM" "$E_UPDATE"
	if [ "$status" != "remove" ] && [ -f "$TULIO/web/api/index.php" ]; then
		sed -i 's|//die("Error: Disabled");|die("Error: Disabled");|g' $TULIO/web/api/index.php
	fi
fi

if [ "$status" = "remove" ]; then
	if [ ! -f "$TULIO/web/api/index.php" ]; then
		echo "ERROR: API is not installed."
		exit 1
	else
		rm -f "$TULIO/web/api/index.php"
	fi
fi

#----------------------------------------------------------#
#                       Tulio                             #
#----------------------------------------------------------#

# Logging
if [ "$status" = "enable" ]; then
	$BIN/v-log-action "system" "Warning" "System" "System API access enabled."
else
	$BIN/v-log-action "system" "Info" "System" "System API access disabled."
fi
log_event "$OK" "$ARGUMENTS"

# The status is stated, not left to log_event. Falling off the end of the
# script hands the caller the result of appending a line to the system log,
# which is not what this command was asked to do. v-change-sys-demo-mode runs
# this on the way into demo mode and stops if it fails, so a log that could not
# be written was enough to refuse to enter demo mode after the API had already
# been turned off. Every failure above exits through check_result and keeps its
# own code.
exit "$OK"
