#!/bin/bash
#
# Download the signed DoHzel DNS mobileconfig for an enrolled Mac.
#
# Does not install the profile — deploy dohzel-dns.mobileconfig through your MDM
# (Intune custom profile, Kandji custom profile, Jamf configuration profile, …).
#
# Requires: curl and plutil (both built into macOS). No Python/Ruby needed.
#
# Usage:
#   dohzel-mdm-provision.sh [options]

set -euo pipefail

dohzel_mdm_log() { echo "[dohzel-mdm] $*"; }
dohzel_mdm_die() { dohzel_mdm_log "ERROR: $*"; exit 1; }

dohzel_mdm_need_curl() {
  command -v curl >/dev/null 2>&1 || dohzel_mdm_die "curl is required (/usr/bin/curl on macOS)"
}

dohzel_mdm_need_plutil() {
  command -v plutil >/dev/null 2>&1 || dohzel_mdm_die "plutil is required (built into macOS)"
}

# Read a scalar value at a key path from a JSON file (empty if missing).
dohzel_mdm_json_get() {
  local file="$1" keypath="$2"
  plutil -extract "${keypath}" raw -o - "${file}" 2>/dev/null
}

# Ensure the downloaded file is a mobileconfig, not an HTML error page.
dohzel_mdm_assert_mobileconfig() {
  local path="$1"
  [[ -s "${path}" ]] || dohzel_mdm_die "Profile file is missing or empty: ${path}"
  if head -c 20 "${path}" | grep -qi '<!DOCTYPE'; then
    dohzel_mdm_die "Downloaded file looks like HTML, not a mobileconfig"
  fi
}

# Download the mobileconfig for a device token.
dohzel_mdm_download_mobileconfig() {
  local api_base="$1" device_token="$2" output="$3"
  dohzel_mdm_log "Downloading mobileconfig to ${output}"
  curl -sS -f -o "${output}" \
    -H "Authorization: ${device_token}" \
    "${api_base}/dohzel/device/mobileconfig" \
    || dohzel_mdm_die "mobileconfig download failed (re-enroll with --force?)"
  dohzel_mdm_assert_mobileconfig "${output}"
}

API_BASE="https://api.hafnova.com/api"
DEVICE_TOKEN=""
STATE_DIR="/var/db/dohzel"
STATE_FILE=""
OUTPUT=""

usage() {
  cat <<EOF
Usage: $(basename "$0") [options]

Options:
  --device-token TOKEN   Device token (default: read from enrollment state file)
  --state-file PATH      Enrollment JSON (default: /var/db/dohzel/enrollment.json)
  --output PATH          Output mobileconfig (default: /var/db/dohzel/dohzel-dns.mobileconfig)
  --api-base URL         API root (default: https://api.hafnova.com/api)
  -h, --help             Show this help

Prints the output file path on success (for MDM scripting).
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --device-token) DEVICE_TOKEN="${2:-}"; shift 2 ;;
    --state-file) STATE_FILE="${2:-}"; shift 2 ;;
    --output) OUTPUT="${2:-}"; shift 2 ;;
    --api-base) API_BASE="${2:-}"; shift 2 ;;
    -h|--help) usage; exit 0 ;;
    *) dohzel_mdm_die "Unknown argument: $1 (use --help)" ;;
  esac
done

STATE_DIR="${STATE_DIR:-/var/db/dohzel}"
STATE_FILE="${STATE_FILE:-${STATE_DIR}/enrollment.json}"
OUTPUT="${OUTPUT:-${STATE_DIR}/dohzel-dns.mobileconfig}"

dohzel_mdm_need_curl
mkdir -p "$(dirname "${OUTPUT}")"

if [[ -z "${DEVICE_TOKEN}" ]]; then
  dohzel_mdm_need_plutil
  [[ -f "${STATE_FILE}" ]] || dohzel_mdm_die "No --device-token and missing state file: ${STATE_FILE}"
  DEVICE_TOKEN="$(dohzel_mdm_json_get "${STATE_FILE}" token)"
  [[ -n "${DEVICE_TOKEN}" ]] || dohzel_mdm_die "Could not read token from ${STATE_FILE}"
fi

dohzel_mdm_download_mobileconfig "${API_BASE}" "${DEVICE_TOKEN}" "${OUTPUT}"
dohzel_mdm_log "Profile ready for MDM deployment"
echo "${OUTPUT}"