#!/usr/bin/env bash
set -euo pipefail

# -----------------------------------------------------------------------------
# Trust Infinito Root CA from running container on the host system
# -----------------------------------------------------------------------------

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# shellcheck source=scripts/meta/env/load.sh
source "${SCRIPT_DIR}/../../../meta/env/load.sh"

CONTAINER_NAME="${INFINITO_CONTAINER}"
CA_SRC_PATH="${INFINITO_CA_CERT_HOST}"
CA_DST_PATH="${INFINITO_CA_CERT_HOST}"
CA_DST_DIR="$(dirname "${CA_DST_PATH}")"
CA_TRUST_NAME="infinito-root-ca"

WITH_CA_TRUST_SCRIPT="${SCRIPT_DIR}/../../../../roles/sys-ca-selfsigned/files/shell/with-ca-trust.sh"

log() {
	echo "[network-trust-ca] $*" >&2
}

require() {
	if ! command -v "$1" >/dev/null 2>&1; then
		echo "[network-trust-ca] ERROR: required command not found: $1" >&2
		exit 1
	fi
}

require docker
require sudo

if [ -z "$CONTAINER_NAME" ]; then
	echo "[network-trust-ca] ERROR: INFINITO_CONTAINER is not set" >&2
	exit 2
fi

if [ -z "$CA_SRC_PATH" ]; then
	echo "[network-trust-ca] ERROR: INFINITO_CA_CERT_HOST is not set" >&2
	exit 2
fi

if [ ! -f "$WITH_CA_TRUST_SCRIPT" ]; then
	echo "[network-trust-ca] ERROR: with-ca-trust.sh not found at $WITH_CA_TRUST_SCRIPT" >&2
	exit 3
fi

log "Using container: $CONTAINER_NAME"
log "CA source path (container): $CA_SRC_PATH"
log "CA destination path (host): $CA_DST_PATH"

log "Extracting Root CA from container"
sudo mkdir -p "$CA_DST_DIR"

# nocheck: container-cp - container-to-host CA extraction on the operator host
sudo docker cp \
	"${CONTAINER_NAME}:${CA_SRC_PATH}" \
	"$CA_DST_PATH"

sudo chmod 0644 "$CA_DST_PATH"

log "Installing CA into host trust store"

sudo \
	CA_TRUST_CERT="$CA_DST_PATH" \
	CA_TRUST_NAME="$CA_TRUST_NAME" \
	VERBOSE=1 \
	bash "$WITH_CA_TRUST_SCRIPT"

log "CA trust installation completed successfully"

echo
echo "✅ Root CA trusted on host system"
echo "ℹ️  Restart browsers (Chrome / Firefox) if already running"