#!/bin/bash
# Render the NetBird dashboard static files with the deployment's
# environment (adapted from upstream docker/init_react_envs.sh, without
# the container-specific nginx patching/reload).
#
# Reads /etc/default/netbird-dashboard, renders the pristine tree from
# /usr/share/netbird-dashboard/html into /var/lib/netbird-dashboard/html
# and writes the matching Content-Security-Policy header as an nginx
# snippet to /var/lib/netbird-dashboard/csp.conf. Reload nginx afterwards.
set -e

SRC="/usr/share/netbird-dashboard/html"
DST="/var/lib/netbird-dashboard/html"
CSP_SNIPPET="/var/lib/netbird-dashboard/csp.conf"
DEFAULTS="/etc/default/netbird-dashboard"

if [[ -f "$DEFAULTS" ]]; then
    set -a
    . "$DEFAULTS"
    set +a
else
    echo "$DEFAULTS not found" >&2
    exit 1
fi

for var in AUTH_AUTHORITY AUTH_CLIENT_ID AUTH_SUPPORTED_SCOPES NETBIRD_MGMT_API_ENDPOINT; do
    if [[ -z "${!var}" ]]; then
        echo "$var must be set in $DEFAULTS" >&2
        exit 1
    fi
done

if [[ "${AUTH_AUDIENCE}" == "none" ]]; then
    unset AUTH_AUDIENCE
fi

export AUTH_AUTHORITY
export AUTH_CLIENT_ID
export AUTH_CLIENT_SECRET
export AUTH_AUDIENCE
export AUTH_REDIRECT_URI
export AUTH_SILENT_REDIRECT_URI
export USE_AUTH0=${USE_AUTH0:-false}
export AUTH_SUPPORTED_SCOPES

export NETBIRD_MGMT_API_ENDPOINT=$(echo "$NETBIRD_MGMT_API_ENDPOINT" | sed -E 's/(:80|:443)$//')
export NETBIRD_MGMT_GRPC_API_ENDPOINT
export NETBIRD_HOTJAR_TRACK_ID
export NETBIRD_GOOGLE_ANALYTICS_ID
export NETBIRD_GOOGLE_TAG_MANAGER_ID
export NETBIRD_TOKEN_SOURCE=${NETBIRD_TOKEN_SOURCE:-accessToken}
export NETBIRD_DRAG_QUERY_PARAMS=${NETBIRD_DRAG_QUERY_PARAMS:-false}
export NETBIRD_AUTH_SERVICE_URL
export NETBIRD_WASM_PATH
export NETBIRD_CSP
export NETBIRD_LICENSED=${NETBIRD_LICENSED:-false}
export NETBIRD_CLOUD=${NETBIRD_CLOUD:-false}
export NETBIRD_AGENT_NETWORK_ONLY=${NETBIRD_AGENT_NETWORK_ONLY:-false}
export NETBIRD_AGENT_NETWORK_ENABLED=${NETBIRD_AGENT_NETWORK_ENABLED:-false}
export NETBIRD_HUBSPOT_PORTAL_ID
export NETBIRD_HUBSPOT_SIGNUP_FORM_ID
export NETBIRD_HUBSPOT_ONBOARDING_FORM_ID
export NETBIRD_HUBSPOT_SURVEY_FORM_ID
export NETBIRD_ANALYTICS_EXCLUDED_EMAILS

# Build CSP (kept aligned with upstream so OIDC discovery and API calls
# pass the policy)
FIRST_PARTY_CSP="pkgs.netbird.io"
FIRST_PARTY_CSP_CONNECT_SRC="wss://*.netbird.io"
THIRD_PARTY_CSP=""
THIRD_PARTY_CSP_CONNECT_SRC="https://api.github.com/repos/netbirdio/netbird/releases/latest https://raw.githubusercontent.com/netbirdio/dashboard/"
THIRD_PARTY_CSP_SCRIPT_SRC=""

CSP_DOMAINS=""
CSP_DOMAINS_CONNECT_SRC=""

if [[ -n "${NETBIRD_CSP}" ]]; then
    CSP_DOMAINS="$CSP_DOMAINS $NETBIRD_CSP"
fi

if [[ -n "${AUTH_AUTHORITY}" ]]; then
    CSP_DOMAINS="$CSP_DOMAINS $AUTH_AUTHORITY"
    AUTH_AUTHORITY_ORIGIN=$(echo "$AUTH_AUTHORITY" | sed -E 's|^(https?://[^/]+).*|\1|')
    CSP_DOMAINS="$CSP_DOMAINS $AUTH_AUTHORITY_ORIGIN"
fi

if [[ -n "${AUTH_AUDIENCE}" && ("${AUTH_AUDIENCE}" == *"http://"* || "${AUTH_AUDIENCE}" == *"https://"*) ]]; then
    CSP_DOMAINS="$CSP_DOMAINS $AUTH_AUDIENCE"
fi

if [[ -n "${NETBIRD_AUTH_SERVICE_URL}" ]]; then
    CSP_DOMAINS="$CSP_DOMAINS $NETBIRD_AUTH_SERVICE_URL"
fi

if [[ -n "${NETBIRD_MGMT_API_ENDPOINT}" ]]; then
    MGMT_DOMAIN=$(echo "$NETBIRD_MGMT_API_ENDPOINT" | sed -E 's|https?://||' | cut -d'/' -f1 | cut -d':' -f1)
    if [[ -n "$MGMT_DOMAIN" ]]; then
        if [[ "$NETBIRD_MGMT_API_ENDPOINT" == https://* ]]; then
            CSP_DOMAINS="$CSP_DOMAINS $NETBIRD_MGMT_API_ENDPOINT"
            CSP_DOMAINS_CONNECT_SRC="$CSP_DOMAINS_CONNECT_SRC wss://$MGMT_DOMAIN"
        elif [[ "$NETBIRD_MGMT_API_ENDPOINT" == http://* ]]; then
            CSP_DOMAINS="$CSP_DOMAINS $NETBIRD_MGMT_API_ENDPOINT"
            CSP_DOMAINS_CONNECT_SRC="$CSP_DOMAINS_CONNECT_SRC ws://$MGMT_DOMAIN"
        fi
    fi
fi

CSP_CONNECT_SRC="$CSP_DOMAINS $CSP_DOMAINS_CONNECT_SRC $FIRST_PARTY_CSP $FIRST_PARTY_CSP_CONNECT_SRC $THIRD_PARTY_CSP $THIRD_PARTY_CSP_CONNECT_SRC"
CSP_FRAME_SRC="$CSP_DOMAINS $FIRST_PARTY_CSP $THIRD_PARTY_CSP"
CSP_SCRIPT_SRC="$CSP_DOMAINS $FIRST_PARTY_CSP $THIRD_PARTY_CSP $THIRD_PARTY_CSP_SCRIPT_SRC"

CSP_CONNECT_SRC=$(echo $CSP_CONNECT_SRC | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')
CSP_FRAME_SRC=$(echo $CSP_FRAME_SRC | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')
CSP_SCRIPT_SRC=$(echo $CSP_SCRIPT_SRC | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')

# Only upgrade http->https when the backend actually is https (see
# upstream commentary): plain-http deployments would break otherwise.
CSP_UPGRADE_INSECURE=" upgrade-insecure-requests;"
if [[ "$NETBIRD_MGMT_API_ENDPOINT" == http://* || "$AUTH_AUTHORITY" == http://* ]]; then
    CSP_UPGRADE_INSECURE=""
fi

CSP_POLICY="default-src 'none'; connect-src 'self' $CSP_CONNECT_SRC; frame-src 'self' $CSP_FRAME_SRC; script-src 'self' 'wasm-unsafe-eval' $CSP_SCRIPT_SRC; font-src 'self'; img-src * data:; manifest-src 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';$CSP_UPGRADE_INSECURE"

mkdir -p "$(dirname "$CSP_SNIPPET")"
printf 'add_header Content-Security-Policy "%s" always;\n' "$CSP_POLICY" > "$CSP_SNIPPET"

# Render the static tree
rm -rf "$DST"
mkdir -p "$DST"
cp -a "$SRC/." "$DST/"

ENV_STR='$USE_AUTH0 $AUTH_AUDIENCE $AUTH_AUTHORITY $AUTH_CLIENT_ID $AUTH_CLIENT_SECRET $AUTH_SUPPORTED_SCOPES $NETBIRD_MGMT_API_ENDPOINT $NETBIRD_MGMT_GRPC_API_ENDPOINT $NETBIRD_HOTJAR_TRACK_ID $NETBIRD_GOOGLE_ANALYTICS_ID $NETBIRD_GOOGLE_TAG_MANAGER_ID $AUTH_REDIRECT_URI $AUTH_SILENT_REDIRECT_URI $NETBIRD_TOKEN_SOURCE $NETBIRD_DRAG_QUERY_PARAMS $NETBIRD_AUTH_SERVICE_URL $NETBIRD_WASM_PATH $NETBIRD_LICENSED $NETBIRD_CLOUD $NETBIRD_AGENT_NETWORK_ONLY $NETBIRD_AGENT_NETWORK_ENABLED $NETBIRD_HUBSPOT_PORTAL_ID $NETBIRD_HUBSPOT_SIGNUP_FORM_ID $NETBIRD_HUBSPOT_ONBOARDING_FORM_ID $NETBIRD_HUBSPOT_SURVEY_FORM_ID $NETBIRD_ANALYTICS_EXCLUDED_EMAILS'

OIDC_TRUSTED_DOMAINS="$DST/OidcTrustedDomains.js"
if [[ -f "$OIDC_TRUSTED_DOMAINS.tmpl" ]]; then
    envsubst "$ENV_STR" < "$OIDC_TRUSTED_DOMAINS.tmpl" > "$OIDC_TRUSTED_DOMAINS"
fi

for f in $(grep -R -l AUTH_SUPPORTED_SCOPES "$DST"); do
    cp "$f" "$f".copy
    envsubst "$ENV_STR" < "$f".copy > "$f"
    rm "$f".copy
done

echo "Dashboard rendered to $DST (CSP snippet: $CSP_SNIPPET). Reload nginx to apply."
