#!/usr/bin/env bash
#
# Enable system-level security for Aspera Connect Server
#
# Aspera, Inc. - 2012

function _usage
{
  echo
  echo "  Usage: $0 enable|disable"
  echo
  echo "  Enable system-level security for Aspera Connect Server"
  echo
  exit 1
}

case `uname` in
  Isilon*)
      INSTALLDIR=/usr/local/aspera
      OWNER=root:wheel
      WEBUSER=daemon
      SUDOERS=/usr/local/etc/sudoers
      ;;
  Darwin*)
      INSTALLDIR=/Library/Aspera
      OWNER=root:admin
      WEBUSER=_www
      SUDOERS=/etc/sudoers
      ;;
  Sun*)
      PATH=/usr/xpg4/bin:/opt/csw/bin:$PATH
      sed  "s/\'sudo\'/\'\/opt\/csw\/bin\/sudo\'/g" /opt/aspera/var/webtools/scripts/aspera-dirlist.pl > /tmp/dirlist.$$
      if ! test -e /opt/aspera/var/webtools/scripts/aspera-dirlist.pl.orig; then
        cp /opt/aspera/var/webtools/scripts/aspera-dirlist.pl /opt/aspera/var/webtools/scripts/aspera-dirlist.pl.orig
      fi
      mv /tmp/dirlist.$$ /opt/aspera/var/webtools/scripts/aspera-dirlist.pl
      chmod +x /opt/aspera/var/webtools/scripts/aspera-dirlist.pl
      echo; echo "Ensure you have sudo installed in /opt/csw/bin/sudo"; echo
      INSTALLDIR=/opt/aspera
      OWNER=root:root
      WEBUSER=nobody
      SUDOERS=/etc/sudoers
      ;;
  *)
      INSTALLDIR=/opt/aspera
      OWNER=root:root
      WEBUSER=apache
      SUDOERS=/etc/sudoers
      ;;
esac

# Must run as root
if test `id -u` -ne 0; then echo You must be root; exit 1; fi

REQFILE=$INSTALLDIR/var/webtools/scripts/require-secure

function _sudoers_text
{
    echo "# BEGIN Aspera Connect Server"
    echo "# The user account that runs the web server will impersonate"
    echo "# the logged-in user to present that user's files and folders."
    echo "Defaults env_keep += \"SERVER_NAME REQUEST_URI REQUEST_METHOD REMOTE_USER QUERY_STRING CONTENT_LENGTH SESSION_ID CSRF_TOKEN\""
    echo "Defaults:$WEBUSER !requiretty"
    echo "$WEBUSER ALL=(ALL) NOPASSWD: $INSTALLDIR/var/webtools/scripts/aspera-dirlist.pl"
    echo "# END Aspera Connect Server"
}

function _enable
{
    err=0
    touch $REQFILE || err=1
    chown $OWNER $REQFILE || err=1
    chmod 400 $REQFILE || err=1
    if test $err -eq 1; then
        echo "Failed to create security file: $REQFILE"
        exit 1
    fi

    echo -n "User running apache (default $WEBUSER): " && read WEBUSER_ENTERED
    if test "_$WEBUSER_ENTERED" != "_"; then
        WEBUSER=$WEBUSER_ENTERED
    fi

    if test "`uname`" = "Darwin"; then
        # On Mac make sure the session directory is owned by _www
        mkdir -p /Library/Aspera/var/run/aspera/dirlist/session_data
        chown $WEBUSER:$WEBUSER /Library/Aspera/var/run/aspera/dirlist/session_data
    fi

    echo
    echo "Successfully enabled Aspera Connect Server system-level security!"
    echo
    echo "In order to complete this operation, add the following to your $SUDOERS file."
    echo
    _sudoers_text
    echo
}

function _disable
{
    echo
    err=0

    if test `uname` = "Darwin"; then
        # On Mac make sure the session directory is owned by _www
        mkdir -p /Library/Aspera/var/run/aspera/dirlist/session_data
        chown $WEBUSER:$WEBUSER /Library/Aspera/var/run/aspera/dirlist/session_data
    fi

    if test -f $REQFILE; then
        rm $REQFILE || err=1
        if test $err -eq 1; then
            echo "Failed to remove security file: $REQFILE"
            exit 1
        fi
        echo "  Successfully disabled Aspera Connect Server system-level security!"
    else
        echo "  Already disabled!"
    fi
    echo "  In order to completely disable this feature, remove the following from your /etc/sudoers file:"
    echo
    _sudoers_text
    echo
}

if test $# -ne 1; then
    _usage
fi

if test $1 == enable; then
    _enable
    exit 0
fi

if test $1 == disable; then
    _disable
    exit 0
fi

_usage
exit 1
