#!/usr/bin/env bash
set -u
set -o pipefail

script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cert_path=""

if [[ -f "$script_dir/connpack-root-ca.cer" ]]; then
    cert_path="$script_dir/connpack-root-ca.cer"
elif [[ -f "$script_dir/connpack-root-ca.crt" ]]; then
    cert_path="$script_dir/connpack-root-ca.crt"
else
    echo "FAIL[2]: Certificate file not found. Place connpack-root-ca.cer or connpack-root-ca.crt next to this script."
    exit 2
fi

run_privileged() {
    if [[ "$(id -u)" -eq 0 ]]; then
        "$@"
        return $?
    fi

    if command -v sudo >/dev/null 2>&1; then
        sudo "$@"
        return $?
    fi

    return 127
}

debian_target="/usr/local/share/ca-certificates/connpack-root-ca.crt"
if [[ -d "/usr/local/share/ca-certificates" ]]; then
    if run_privileged cp -f "$cert_path" "$debian_target"; then
        if command -v update-ca-certificates >/dev/null 2>&1; then
            if run_privileged update-ca-certificates; then
                echo "OK[0]: Installed ConnPack root certificate using Debian/Ubuntu trust store."
                exit 0
            fi
            echo "FAIL[5]: update-ca-certificates failed after copying certificate."
            exit 5
        fi
    else
        echo "FAIL[3]: Cannot copy certificate to Debian/Ubuntu trust store (need root or sudo)."
        exit 3
    fi
fi

rhel_target="/etc/pki/ca-trust/source/anchors/connpack-root-ca.crt"
if [[ -d "/etc/pki/ca-trust/source/anchors" ]]; then
    if run_privileged cp -f "$cert_path" "$rhel_target"; then
        if command -v update-ca-trust >/dev/null 2>&1; then
            if run_privileged update-ca-trust extract; then
                echo "OK[0]: Installed ConnPack root certificate using RHEL/CentOS/Fedora trust store."
                exit 0
            fi
            echo "FAIL[6]: update-ca-trust extract failed after copying certificate."
            exit 6
        fi
    else
        echo "FAIL[3]: Cannot copy certificate to RHEL/CentOS/Fedora trust store (need root or sudo)."
        exit 3
    fi
fi

echo "FAIL[4]: No supported Linux trust store tooling was detected."
echo "Manual steps:"
echo "  Debian/Ubuntu: copy to /usr/local/share/ca-certificates/connpack-root-ca.crt and run update-ca-certificates"
echo "  RHEL/CentOS/Fedora: copy to /etc/pki/ca-trust/source/anchors/connpack-root-ca.crt and run update-ca-trust extract"
exit 4