#!/bin/sh
# MyLogin.world: connects this firewall to your dashboard, then installs os-mylogin 1.0.0 and runs `mylogin-opnsense setup`.
# Run the command your dashboard shows: --code is valid 24 hours, --address is where you open OPNsense.
set -eu
usage() { echo "Usage: curl -fsSL https://mylogin.world.compas.cs.stonybrook.edu/install/opnsense | sh -s -- --code <code> --address <address>. Copy the command from your dashboard." >&2; exit 1; }
code= address=
while [ $# -gt 0 ]; do
  [ $# -ge 2 ] || usage
  case $1 in --code) code=$2 ;; --address) address=$2 ;; *) usage ;; esac
  shift 2
done
[ -n "$code" ] && [ -n "$address" ] || usage
[ "$(id -u)" = 0 ] || { echo "Run this as root (console or SSH, option 8: Shell)." >&2; exit 1; }
[ -f /usr/local/opnsense/mvc/app/library/OPNsense/Auth/SSOProviders/ISSOContainer.php ] || { echo "This needs OPNsense 25.1.9 or later." >&2; exit 1; }
arch=$(uname -p)
case $arch in
  amd64) file=os-mylogin-1.0.0-amd64.pkg sum=ab26067d49f9324b0584797eea59b1e155e6d4283832b29ea860f78516350254 ;;
  *) echo "Unsupported architecture: $arch" >&2; exit 1 ;;
esac
res=$(jq -n --arg code "$code" --arg address "$address" --arg hostname "$(hostname)" '{$code, $address, $hostname}' |
  curl -sS -H 'content-type: application/json' --data-binary @- -w '\n%{http_code}' https://mylogin.world.compas.cs.stonybrook.edu/install/opnsense) || { echo "Could not reach https://mylogin.world.compas.cs.stonybrook.edu." >&2; exit 1; }
status=$(printf '%s\n' "$res" | tail -n 1) body=$(printf '%s\n' "$res" | sed '$d')
field() { printf '%s' "$body" | jq -r "try (.$1 | strings) catch empty" 2>/dev/null || true; }
[ "$status" = 200 ] || { msg=$(field error.message); echo "${msg:-Setup failed (HTTP $status). Try again.}" >&2; exit 1; }
slug=$(field slug) relay=$(field relay) app_url=$(field appUrl) admin=$(field admin)
dir=$(mktemp -d); trap 'rm -rf "$dir"' EXIT
curl -fsSL -o "$dir/$file" https://mylogin.world.compas.cs.stonybrook.edu/downloads/opnsense/"$file"
[ "$(sha256 -q "$dir/$file")" = "$sum" ] || { echo "Checksum mismatch; nothing installed." >&2; exit 1; }
pkg add -f "$dir/$file"
/usr/local/sbin/mylogin-opnsense setup --slug "$slug" --relay "$relay" --app-url "$app_url" --admin "$admin"