#!/bin/sh
set -eu
umask 077

INBOX="/path/to/olivetin/export/device-sync"
DESIRED="$INBOX/vpn-clients.desired"
READY="$INBOX/vpn-clients.ready"
STATUS="$INBOX/gateway.status"   # generischer Name

WRAPPER="/path/to/vpn-platform/gateway/olivetin-vpn-client-sync.sh"
STATE="/path/to/vpn-platform/gateway/config/.olivetin-sync-hash"

PUBLISH="/path/to/OliveTinSync"
APPROVED="$PUBLISH/vpn-clients.approved"

write_status() {
  TMP_STATUS="${STATUS}.tmp.$$"
  printf '%s\n' "$1" > "$TMP_STATUS"
  mv "$TMP_STATUS" "$STATUS"
}

[ -r "$DESIRED" ] && [ -r "$READY" ] || {
  write_status "WAITING keine bereite Sollliste"
  exit 0
}

EXPECTED="$(tr -d '\r\n' < "$READY")"
ACTUAL="$(sha256sum "$DESIRED" | awk '{print $1}')"

[ -n "$EXPECTED" ] && [ "$EXPECTED" = "$ACTUAL" ] || {
  write_status "STOPP Hash der Sollliste stimmt nicht"
  exit 65
}

CURRENT="$(cat "$STATE" 2>/dev/null || true)"
PUBLISHED_HASH="$(sha256sum "$APPROVED" 2>/dev/null | awk '{print $1}' || true)"

if [ "$CURRENT" = "$ACTUAL" ] && [ "$PUBLISHED_HASH" = "$ACTUAL" ]; then
  write_status "OK unveraendert SHA256=$ACTUAL"
  exit 0
fi

"$WRAPPER" apply < "$DESIRED"

TMP_APPROVED="${APPROVED}.tmp.$$"
TMP_HASH="${APPROVED}.sha256.tmp.$$"
TMP_READY="${PUBLISH}/vpn-clients.ready.tmp.$$"

cp "$DESIRED" "$TMP_APPROVED"
chmod 644 "$TMP_APPROVED"
printf '%s\n' "$ACTUAL" > "$TMP_HASH"
printf '%s\n' "$ACTUAL" > "$TMP_READY"

mv "$TMP_APPROVED" "$APPROVED"
mv "$TMP_HASH" "${APPROVED}.sha256"
mv "$TMP_READY" "$PUBLISH/vpn-clients.ready"
printf '%s\n' "$ACTUAL" > "$STATE"

write_status "OK angewendet und veroeffentlicht SHA256=$ACTUAL"