/******************************************************************************
 * Icinga 2                                                                   *
 * Copyright (C) 2012-2017 Icinga Development Team (https://www.icinga.com/)  *
 *                                                                            *
 * This program is free software; you can redistribute it and/or              *
 * modify it under the terms of the GNU General Public License                *
 * as published by the Free Software Foundation; either version 2             *
 * of the License, or (at your option) any later version.                     *
 *                                                                            *
 * This program is distributed in the hope that it will be useful,            *
 * but WITHOUT ANY WARRANTY; without even the implied warranty of             *
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              *
 * GNU General Public License for more details.                               *
 *                                                                            *
 * You should have received a copy of the GNU General Public License          *
 * along with this program; if not, write to the Free Software Foundation     *
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
 ******************************************************************************/

#include "cli/nodewizardcommand.hpp"
#include "cli/nodeutility.hpp"
#include "cli/featureutility.hpp"
#include "cli/apisetuputility.hpp"
#include "remote/apilistener.hpp"
#include "remote/pkiutility.hpp"
#include "base/logger.hpp"
#include "base/console.hpp"
#include "base/application.hpp"
#include "base/tlsutility.hpp"
#include "base/scriptglobal.hpp"
#include "base/exception.hpp"
#include <boost/algorithm/string/join.hpp>
#include <boost/algorithm/string/replace.hpp>
#include <boost/algorithm/string/case_conv.hpp>
#include <iostream>
#include <string>
#include <fstream>
#include <vector>

using namespace icinga;
namespace po = boost::program_options;

REGISTER_CLICOMMAND("node/wizard", NodeWizardCommand);

String NodeWizardCommand::GetDescription(void) const
{
	return "Wizard for Icinga 2 node setup.";
}

String NodeWizardCommand::GetShortDescription(void) const
{
	return "wizard for node setup";
}

ImpersonationLevel NodeWizardCommand::GetImpersonationLevel(void) const
{
	return ImpersonateRoot;
}

int NodeWizardCommand::GetMaxArguments(void) const
{
	return -1;
}

void NodeWizardCommand::InitParameters(boost::program_options::options_description& visibleDesc,
    boost::program_options::options_description& hiddenDesc) const
{
	visibleDesc.add_options()
		("verbose", "increase log level");
}

/**
 * The entry point for the "node wizard" CLI command.
 *
 * @returns An exit status.
 */
int NodeWizardCommand::Run(const boost::program_options::variables_map& vm,
    const std::vector<std::string>& ap) const
{
	if (!vm.count("verbose"))
		Logger::SetConsoleLogSeverity(LogCritical);

	/*
	 * The wizard will get all information from the user,
	 * and then call all required functions.
	 */

	std::cout << ConsoleColorTag(Console_Bold | Console_ForegroundBlue)
	    << "Welcome to the Icinga 2 Setup Wizard!\n"
	    << "\n"
	    << "We will guide you through all required configuration details.\n"
	    << "\n"
	    << ConsoleColorTag(Console_Normal);

	/* 0. master or node setup?
	 * 1. Ticket
	 * 2. Master information for autosigning
	 * 3. Trusted cert location
	 * 4. CN to use (defaults to FQDN)
	 * 5. Local CA
	 * 6. New self signed certificate
	 * 7. Request signed certificate from master
	 * 8. copy key information to /var/lib/icinga2/certs
	 * 9. enable ApiListener feature
	 * 10. generate zones.conf with endpoints and zone objects
	 * 11. set NodeName = cn in constants.conf
	 * 12. reload icinga2, or tell the user to
	 */

	std::string answer;
	/* master or satellite/client setup */
	std::cout << ConsoleColorTag(Console_Bold)
	    << "Please specify if this is a satellite/client setup "
	    << "('n' installs a master setup)" << ConsoleColorTag(Console_Normal)
	    << " [Y/n]: ";
	std::getline (std::cin, answer);

	boost::algorithm::to_lower(answer);

	String choice = answer;

	std::cout << "\n";

	int res = 0;

	if (choice.Contains("n"))
		res = MasterSetup();
	else
		res = ClientSetup();

	if (res != 0)
		return res;

	std::cout << "\n";
	std::cout << ConsoleColorTag(Console_Bold | Console_ForegroundGreen)
	    << "Done.\n\n"
	    << ConsoleColorTag(Console_Normal);

	std::cout << ConsoleColorTag(Console_Bold | Console_ForegroundRed)
	    << "Now restart your Icinga 2 daemon to finish the installation!\n"
	    << ConsoleColorTag(Console_Normal);

	return 0;
}

int NodeWizardCommand::ClientSetup(void) const
{
	std::string answer;
	String choice;
	bool connectToParent = false;

	std::cout << "Starting the Client/Satellite setup routine...\n\n";

	/* CN */
	std::cout << ConsoleColorTag(Console_Bold)
	    << "Please specify the common name (CN)"
	    << ConsoleColorTag(Console_Normal)
	    << " [" << Utility::GetFQDN() << "]: ";

	std::getline(std::cin, answer);

	if (answer.empty())
		answer = Utility::GetFQDN();

	String cn = answer;
	cn = cn.Trim();

	std::vector<std::string> endpoints;

	String endpointBuffer;

	std::cout << ConsoleColorTag(Console_Bold)
	    << "\nPlease specify the parent endpoint(s) (master or satellite) where this node should connect to:"
	    << ConsoleColorTag(Console_Normal) << "\n";
	String parentEndpointName;

wizard_endpoint_loop_start:

	std::cout << ConsoleColorTag(Console_Bold)
	    << "Master/Satellite Common Name" << ConsoleColorTag(Console_Normal)
	    << " (CN from your master/satellite node): ";

	std::getline(std::cin, answer);

	if (answer.empty()) {
		Log(LogWarning, "cli", "Master/Satellite CN is required! Please retry.");
		goto wizard_endpoint_loop_start;
	}

	endpointBuffer = answer;
	endpointBuffer = endpointBuffer.Trim();

	std::cout << "\nDo you want to establish a connection to the parent node "
	    << ConsoleColorTag(Console_Bold) << "from this node?"
	    << ConsoleColorTag(Console_Normal) << " [Y/n]: ";

	std::getline (std::cin, answer);
	boost::algorithm::to_lower(answer);
	choice = answer;

	String parentEndpointPort = "5665";

	if (choice.Contains("n")) {
		connectToParent = false;

		Log(LogWarning, "cli", "Node to master/satellite connection setup skipped");
		std::cout << "Connection setup skipped. Please configure your parent node to\n"
		    << "connect to this node by setting the 'host' attribute for the node Endpoint object.\n";

	} else  {
		connectToParent = true;

		std::cout << ConsoleColorTag(Console_Bold)
		    << "Please specify the master/satellite connection information:"
		    << ConsoleColorTag(Console_Normal) << "\n"
		    << ConsoleColorTag(Console_Bold) << "Master/Satellite endpoint host"
		    << ConsoleColorTag(Console_Normal) << " (IP address or FQDN): ";

		std::getline(std::cin, answer);

		if (answer.empty()) {
			Log(LogWarning, "cli", "Please enter the parent endpoint (master/satellite) connection information.");
			goto wizard_endpoint_loop_start;
		}

		String tmp = answer;
		tmp = tmp.Trim();

		endpointBuffer += "," + tmp;
		parentEndpointName = tmp;

		std::cout << ConsoleColorTag(Console_Bold)
		     << "Master/Satellite endpoint port" << ConsoleColorTag(Console_Normal)
		     << " [" << parentEndpointPort << "]: ";

		std::getline(std::cin, answer);

		if (!answer.empty())
			parentEndpointPort = answer;

		endpointBuffer += "," + parentEndpointPort.Trim();
	}

	endpoints.push_back(endpointBuffer);

	std::cout << ConsoleColorTag(Console_Bold) << "\nAdd more master/satellite endpoints?"
	    << ConsoleColorTag(Console_Normal) << " [y/N]: ";
	std::getline (std::cin, answer);

	boost::algorithm::to_lower(answer);

	choice = answer;

	if (choice.Contains("y"))
		goto wizard_endpoint_loop_start;

	String parentHost, parentPort;

	for (const String& endpoint : endpoints) {
		std::vector<String> tokens = endpoint.Split(",");

		if (tokens.size() > 1)
			parentHost = tokens[1];

		if (tokens.size() > 2)
			parentPort = tokens[2];
	}

	/* workaround for fetching the master cert */
	String certsDir = ApiListener::GetCertsDir();
	Utility::MkDirP(certsDir, 0700);

	String user = ScriptGlobal::Get("RunAsUser");
	String group = ScriptGlobal::Get("RunAsGroup");

	if (!Utility::SetFileOwnership(certsDir, user, group)) {
		Log(LogWarning, "cli")
		    << "Cannot set ownership for user '" << user
		    << "' group '" << group
		    << "' on file '" << certsDir << "'. Verify it yourself!";
	}

	String nodeCert = certsDir + "/" + cn + ".crt";
	String nodeKey = certsDir + "/" + cn + ".key";

	if (Utility::PathExists(nodeKey))
		NodeUtility::CreateBackupFile(nodeKey, true);
	if (Utility::PathExists(nodeCert))
		NodeUtility::CreateBackupFile(nodeCert);

	if (PkiUtility::NewCert(cn, nodeKey, Empty, nodeCert) > 0) {
		Log(LogCritical, "cli")
		    << "Failed to create new self-signed certificate for CN '"
		    << cn << "'. Please try again.";
		return 1;
	}

	/* fix permissions: root -> icinga daemon user */
	if (!Utility::SetFileOwnership(nodeKey, user, group)) {
		Log(LogWarning, "cli")
		    << "Cannot set ownership for user '" << user
		    << "' group '" << group
		    << "' on file '" << nodeKey << "'. Verify it yourself!";
	}

	boost::shared_ptr<X509> trustedParentCert;

	/* Check whether we should connect to the parent node and present its trusted certificate. */
	if (connectToParent) {
		//save-cert and store the master certificate somewhere
		Log(LogInformation, "cli")
		    << "Fetching public certificate from master ("
		    << parentHost << ", " << parentPort << "):\n";

		trustedParentCert = PkiUtility::FetchCert(parentHost, parentPort);
		if (!trustedParentCert) {
			Log(LogCritical, "cli", "Peer did not present a valid certificate.");
			return 1;
		}

		std::cout << ConsoleColorTag(Console_Bold) << "Parent certificate information:\n"
		    << ConsoleColorTag(Console_Normal) << PkiUtility::GetCertificateInformation(trustedParentCert)
		    << ConsoleColorTag(Console_Bold) << "\nIs this information correct?"
		    << ConsoleColorTag(Console_Normal) << " [y/N]: ";

		std::getline (std::cin, answer);
		boost::algorithm::to_lower(answer);
		if (answer != "y") {
			Log(LogWarning, "cli", "Process aborted.");
			return 1;
		}

		Log(LogInformation, "cli", "Received trusted parent certificate.\n");
	}

wizard_ticket:
	String nodeCA = certsDir + "/ca.crt";
	String ticket;

	/* Check whether we can connect to the parent node and fetch the client and CA certificate. */
	if (connectToParent) {
		std::cout << ConsoleColorTag(Console_Bold)
		    << "\nPlease specify the request ticket generated on your Icinga 2 master (optional)."
		    << ConsoleColorTag(Console_Normal) << "\n"
		    << " (Hint: # icinga2 pki ticket --cn '" << cn << "'): ";

		std::getline(std::cin, answer);

		if (answer.empty()) {
			std::cout << ConsoleColorTag(Console_Bold) << "\n"
			    << "No ticket was specified. Please approve the certificate signing request manually\n"
			    << "on the master (see 'icinga2 ca list' and 'icinga2 ca sign --help' for details)."
			    << ConsoleColorTag(Console_Normal) << "\n";
		}

		ticket = answer;
		ticket = ticket.Trim();

		if (ticket.IsEmpty()) {
			Log(LogInformation, "cli")
			    << "Requesting certificate without a ticket.";
		} else {
			Log(LogInformation, "cli")
			    << "Requesting certificate with ticket '" << ticket << "'.";
		}

		if (Utility::PathExists(nodeCA))
			NodeUtility::CreateBackupFile(nodeCA);
		if (Utility::PathExists(nodeCert))
			NodeUtility::CreateBackupFile(nodeCert);

		if (PkiUtility::RequestCertificate(parentHost, parentPort, nodeKey,
		    nodeCert, nodeCA, trustedParentCert, ticket) > 0) {
			Log(LogCritical, "cli")
			    << "Failed to fetch signed certificate from master '"
			    << parentHost << ", "
			    << parentPort << "'. Please try again.";
			goto wizard_ticket;
		}

		/* fix permissions (again) when updating the signed certificate */
		if (!Utility::SetFileOwnership(nodeCert, user, group)) {
			Log(LogWarning, "cli")
			    << "Cannot set ownership for user '" << user
			    << "' group '" << group << "' on file '"
			    << nodeCert << "'. Verify it yourself!";
		}
	} else {
		/* We cannot retrieve the parent certificate.
		 * Tell the user to manually copy the ca.crt file
		 * into LocalStateDir + "/lib/icinga2/certs"
		 */

		std::cout <<  ConsoleColorTag(Console_Bold)
		    << "\nNo connection to the parent node was specified.\n\n"
		    << "Please copy the public CA certificate from your master/satellite\n"
		    << "into '" << nodeCA << "' before starting Icinga 2.\n"
		    << ConsoleColorTag(Console_Normal);

		if (Utility::PathExists(nodeCA)) {
			std::cout <<  ConsoleColorTag(Console_Bold)
			    << "\nFound public CA certificate in '" << nodeCA << "'.\n"
			    << "Please verify that it is the same as on your master/satellite.\n"
			    << ConsoleColorTag(Console_Normal);
		}

	}

	/* apilistener config */
	std::cout << ConsoleColorTag(Console_Bold)
	    << "\nPlease specify the API bind host/port"
	    << ConsoleColorTag(Console_Normal) << " (optional):\n"
	    << ConsoleColorTag(Console_Bold) << "Bind Host"
	    << ConsoleColorTag(Console_Normal) << " []: ";

	std::getline(std::cin, answer);

	String bindHost = answer;
	bindHost = bindHost.Trim();

	std::cout << "Bind Port []: ";

	std::getline(std::cin, answer);

	String bindPort = answer;
	bindPort = bindPort.Trim();

	std::cout << ConsoleColorTag(Console_Bold) << "\n"
	    << "Accept config from parent node?" << ConsoleColorTag(Console_Normal)
	    << " [y/N]: ";
	std::getline(std::cin, answer);
	boost::algorithm::to_lower(answer);
	choice = answer;

	String acceptConfig = choice.Contains("y") ? "true" : "false";

	std::cout << ConsoleColorTag(Console_Bold)
	    << "Accept commands from parent node?" << ConsoleColorTag(Console_Normal)
	    << " [y/N]: ";
	std::getline(std::cin, answer);
	boost::algorithm::to_lower(answer);
	choice = answer;

	String acceptCommands = choice.Contains("y") ? "true" : "false";

	std::cout << "\n";

	std::cout << ConsoleColorTag(Console_Bold | Console_ForegroundGreen)
	    << "Reconfiguring Icinga...\n"
	    << ConsoleColorTag(Console_Normal);

	/* disable the notifications feature on client nodes */
	Log(LogInformation, "cli", "Disabling the Notification feature.");

	std::vector<std::string> disable;
	disable.push_back("notification");
	FeatureUtility::DisableFeatures(disable);

	Log(LogInformation, "cli", "Enabling the ApiListener feature.");

	std::vector<std::string> enable;
	enable.push_back("api");
	FeatureUtility::EnableFeatures(enable);

	String apiConfPath = FeatureUtility::GetFeaturesAvailablePath() + "/api.conf";
	NodeUtility::CreateBackupFile(apiConfPath);

	std::fstream fp;
	String tempApiConfPath = Utility::CreateTempFile(apiConfPath + ".XXXXXX", 0644, fp);

	fp << "/**\n"
	    << " * The API listener is used for distributed monitoring setups.\n"
	    << " */\n"
	    << "object ApiListener \"api\" {\n"
	    << "  accept_config = " << acceptConfig << "\n"
	    << "  accept_commands = " << acceptCommands << "\n";

	if (!bindHost.IsEmpty())
		fp << "  bind_host = \"" << bindHost << "\"\n";
	if (!bindPort.IsEmpty())
		fp << "  bind_port = " << bindPort << "\n";

	fp << "}\n";

	fp.close();

#ifdef _WIN32
	_unlink(apiConfPath.CStr());
#endif /* _WIN32 */

	if (rename(tempApiConfPath.CStr(), apiConfPath.CStr()) < 0) {
		BOOST_THROW_EXCEPTION(posix_error()
		    << boost::errinfo_api_function("rename")
		    << boost::errinfo_errno(errno)
		    << boost::errinfo_file_name(tempApiConfPath));
	}

	/* apilistener config */
	Log(LogInformation, "cli", "Generating local zones.conf.");

	std::vector<String> globalZones;

	globalZones.push_back("global-templates");
	globalZones.push_back("director-global");

	NodeUtility::GenerateNodeIcingaConfig(endpoints, globalZones);

	if (cn != Utility::GetFQDN()) {
		Log(LogWarning, "cli")
		    << "CN '" << cn << "' does not match the default FQDN '"
		    << Utility::GetFQDN() << "'. Requires update for NodeName constant in constants.conf!";
	}

	Log(LogInformation, "cli", "Updating constants.conf.");

	String constants_file = Application::GetSysconfDir() + "/icinga2/constants.conf";

	NodeUtility::CreateBackupFile(constants_file);

	NodeUtility::UpdateConstant("NodeName", cn);
	NodeUtility::UpdateConstant("ZoneName", cn);

	if (!ticket.IsEmpty()) {
		String ticketPath = ApiListener::GetCertsDir() + "/ticket";

		String tempTicketPath = Utility::CreateTempFile(ticketPath + ".XXXXXX", 0600, fp);

		if (!Utility::SetFileOwnership(tempTicketPath, user, group)) {
			Log(LogWarning, "cli")
			    << "Cannot set ownership for user '" << user
			    << "' group '" << group
			    << "' on file '" << tempTicketPath << "'. Verify it yourself!";
		}

		fp << ticket;

		fp.close();

#ifdef _WIN32
		_unlink(ticketPath.CStr());
#endif /* _WIN32 */

		if (rename(tempTicketPath.CStr(), ticketPath.CStr()) < 0) {
			BOOST_THROW_EXCEPTION(posix_error()
			    << boost::errinfo_api_function("rename")
			    << boost::errinfo_errno(errno)
			    << boost::errinfo_file_name(tempTicketPath));
		}
	}

	return 0;
}

int NodeWizardCommand::MasterSetup(void) const
{
	std::string answer;
	String choice;

	std::cout << ConsoleColorTag(Console_Bold) << "Starting the Master setup routine...\n\n";

	/* CN */
	std::cout << ConsoleColorTag(Console_Bold)
	    << "Please specify the common name" << ConsoleColorTag(Console_Normal)
	    << " (CN) [" << Utility::GetFQDN() << "]: ";

	std::getline(std::cin, answer);

	if (answer.empty())
		answer = Utility::GetFQDN();

	String cn = answer;
	cn = cn.Trim();

	std::cout << ConsoleColorTag(Console_Bold | Console_ForegroundGreen)
	    << "Reconfiguring Icinga...\n"
	    << ConsoleColorTag(Console_Normal);

	/* check whether the user wants to generate a new certificate or not */
	String existing_path = ApiListener::GetCertsDir() + "/" + cn + ".crt";

	std::cout << ConsoleColorTag(Console_Normal)
	    << "Checking for existing certificates for common name '" << cn << "'...\n";

	if (Utility::PathExists(existing_path)) {
		std::cout << "Certificate '" << existing_path << "' for CN '"
		    << cn << "' already existing. Skipping certificate generation.\n";
	} else {
		std::cout << "Certificates not yet generated. Running 'api setup' now.\n";
		ApiSetupUtility::SetupMasterCertificates(cn);
	}

	std::cout << ConsoleColorTag(Console_Bold)
	    << "Generating master configuration for Icinga 2.\n"
	    << ConsoleColorTag(Console_Normal);
	ApiSetupUtility::SetupMasterApiUser();

	if (!FeatureUtility::CheckFeatureEnabled("api"))
		ApiSetupUtility::SetupMasterEnableApi();
	else
		std::cout << "'api' feature already enabled.\n";

	std::vector<String> globalZones;

	globalZones.push_back("global-templates");
	globalZones.push_back("director-global");

	NodeUtility::GenerateNodeMasterIcingaConfig(globalZones);

	/* apilistener config */
	std::cout << ConsoleColorTag(Console_Bold)
	    << "Please specify the API bind host/port (optional):\n";
	std::cout << ConsoleColorTag(Console_Bold)
	    << "Bind Host" << ConsoleColorTag(Console_Normal) << " []: ";

	std::getline(std::cin, answer);

	String bindHost = answer;
	bindHost = bindHost.Trim();

	std::cout << ConsoleColorTag(Console_Bold)
	    << "Bind Port" << ConsoleColorTag(Console_Normal) << " []: ";

	std::getline(std::cin, answer);

	String bindPort = answer;
	bindPort = bindPort.Trim();

	/* api feature is always enabled, check above */
	String apiConfPath = FeatureUtility::GetFeaturesAvailablePath() + "/api.conf";
	NodeUtility::CreateBackupFile(apiConfPath);

	std::fstream fp;
	String tempApiConfPath = Utility::CreateTempFile(apiConfPath + ".XXXXXX", 0644, fp);

	fp << "/**\n"
	    << " * The API listener is used for distributed monitoring setups.\n"
	    << " */\n"
	    << "object ApiListener \"api\" {\n";

	if (!bindHost.IsEmpty())
		fp << "  bind_host = \"" << bindHost << "\"\n";
	if (!bindPort.IsEmpty())
		fp << "  bind_port = " << bindPort << "\n";

	fp << "\n"
	    << "  ticket_salt = TicketSalt\n"
	    << "}\n";

	fp.close();

#ifdef _WIN32
	_unlink(apiConfPath.CStr());
#endif /* _WIN32 */

	if (rename(tempApiConfPath.CStr(), apiConfPath.CStr()) < 0) {
		BOOST_THROW_EXCEPTION(posix_error()
		    << boost::errinfo_api_function("rename")
		    << boost::errinfo_errno(errno)
		    << boost::errinfo_file_name(tempApiConfPath));
	}

	/* update constants.conf with NodeName = CN + TicketSalt = random value */
	if (cn != Utility::GetFQDN()) {
		Log(LogWarning, "cli")
		    << "CN '" << cn << "' does not match the default FQDN '"
		    << Utility::GetFQDN() << "'. Requires an update for the NodeName constant in constants.conf!";
	}

	Log(LogInformation, "cli", "Updating constants.conf.");

	String constants_file = Application::GetSysconfDir() + "/icinga2/constants.conf";

	NodeUtility::CreateBackupFile(constants_file);

	NodeUtility::UpdateConstant("NodeName", cn);
	NodeUtility::UpdateConstant("ZoneName", cn);

	String salt = RandomString(16);

	NodeUtility::UpdateConstant("TicketSalt", salt);

	return 0;
}
