#!/bin/sh
#
# SPDX-License-Identifier: BSD-3-Clause
#
# Copyright (c) 2018-2025, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice, this
#   list of conditions and the following disclaimer.
#
# * Redistributions in binary form must reproduce the above copyright notice,
#   this list of conditions and the following disclaimer in the documentation
#   and/or other materials provided with the distribution.
#
# * Neither the name of the copyright holder nor the names of its
#   contributors may be used to endorse or promote products derived from
#   this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

. /usr/local/share/bastille/common.sh

usage() {
    error_notify "Usage: bastille verify [option(s)] RELEASE|TEMPLATE"
    cat << EOF

    Options:

    -x | --debug     Enable debug mode.

EOF
    exit 1
}

verify_release() {

    if [ -f "/bin/midnightbsd-version" ]; then
        error_exit "[ERROR]: Not yet supported on MidnightBSD."
    fi

    if freebsd-version | grep -qi HBSD; then
        error_exit "[ERROR]: Not yet supported on HardenedBSD."
    fi

    if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
        freebsd-update -b "${bastille_releasesdir}/${RELEASE}" --currently-running "${RELEASE}" IDS
    else
        error_exit "[ERROR]: ${RELEASE} not found. See 'bastille bootstrap'."
    fi
}

handle_template_include() {

    case ${TEMPLATE_INCLUDE} in
        http?://*/*/*)
            bastille bootstrap "${TEMPLATE_INCLUDE}"
        ;;
        */*)
            BASTILLE_TEMPLATE_USER=$(echo "${TEMPLATE_INCLUDE}" | awk -F / '{ print $1 }')
            BASTILLE_TEMPLATE_REPO=$(echo "${TEMPLATE_INCLUDE}" | awk -F / '{ print $2 }')
            bastille verify "${BASTILLE_TEMPLATE_USER}/${BASTILLE_TEMPLATE_REPO}"
        ;;
        *)
            error_exit "[ERROR]: Template INCLUDE content not recognized."
    ;;
    esac
}

verify_template() {

    template_path=${bastille_templatesdir}/${BASTILLE_TEMPLATE}
    hook_validate=0

    for hook in TARGET INCLUDE PRE OVERLAY FSTAB PF PKG SYSRC SERVICE CMD Bastillefile; do
        path=${template_path}/${hook}
        if [ -s "${path}" ]; then
            hook_validate=$((_hook_validate+1))
            info 1 "\nDetected ${hook} hook."

            ## line count must match newline count
            # shellcheck disable=SC2046
            # shellcheck disable=SC3003
            if [ $(wc -l "${path}" | awk '{print $1}') -ne "$(tr -d -c '\n' < "${path}" | wc -c)" ]; then
                info 1 "[${hook}]:"
                error_notify "[ERROR]: ${BASTILLE_TEMPLATE}:${hook} [failed]."
                error_notify "Line numbers don't match line breaks."
                error_exit "Template validation failed."
            ## if INCLUDE; recursive verify
            elif [ "${hook}" = 'INCLUDE' ]; then
                info 1 "[${hook}]:"
                cat "${path}"
                while read include; do
                    info 1 "[${hook}]:[${include}]:"
                    TEMPLATE_INCLUDE="${include}"
                    handle_template_include
                done < "${path}"

            ## if tree; tree -a bastille_template/_dir
            elif [ "${hook}" = 'OVERLAY' ]; then
                info 1 "[${hook}]:"
                cat "${path}"
                while read dir; do
                    info 1 "[${hook}]:[${dir}]:"
                        if [ -x "/usr/local/bin/tree" ]; then
                            /usr/local/bin/tree -a "${template_path}/${dir}"
                        else
                           find "${template_path}/${dir}" -print | sed -e 's;[^/]*/;|___;g;s;___|; |;g'
                        fi
                done < "${path}"
            elif [ "${hook}" = 'Bastillefile' ]; then
                info 1 "[${hook}]:"
                cat "${path}"
                while read line; do
                    cmd=$(echo "${line}" | awk '{print tolower($1);}')
                    ## if include; recursive verify
                    if [ "${cmd}" = 'include' ]; then
                        TEMPLATE_INCLUDE=$(echo "${line}" | awk '{print $2;}')
                        handle_template_include
                    fi
                done < "${path}"
            else
                info 1 "[${hook}]:"
                cat "${path}"
            fi
        fi
    done

    # Remove bad templates
    if [ "${hook_validate}" -lt 1 ]; then
        rm -rf "${template_path}"
        error_notify "[ERROR]: No valid template hooks found."
        error_exit "Template discarded."
    fi

    ## if validated; ready to use
    if [ "${hook_validate}" -gt 0 ]; then
        info 1 "\nTemplate ready to use."
    fi
}

# Handle options.
while [ "$#" -gt 0 ]; do
    case "${1}" in
        -h|--help|help)
            usage
            ;;
        -x|--debug)
            enable_debug
            shift
            ;;
        -*)
            error_exit "[ERROR]: Unknown Option: \"${1}\""
            ;;
        *)
            break
            ;;
    esac
done

if [ "$#" -ne 1 ]; then
    usage
fi

bastille_root_check

case "${1}" in
    *-RELEASE|*-release|*-RC[1-9]|*-rc[1-9])
        RELEASE="${1}"
        verify_release
        ;;
    *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
        RELEASE="${1}"
        verify_release
        ;;
    http?*)
        bastille_usage
        ;;
    */*)
        BASTILLE_TEMPLATE="${1}"
        verify_template
        ;;
    *)
        usage
        ;;
esac
