#!/usr/bin/env bash
# reset-setup-token.sh — regenerate the first-run boot token.
#
# Root-only. Refuses to run if the users table already has entries (setup
# is a one-time event — after that, use the app's own password-recovery
# flow to get back in, or wipe + reinstall if you've truly lost everything).
#
# On success, writes a fresh token to /etc/customsso-manager/first-run.token
# (mode 660, root:apache) and prints the setup URL.

set -euo pipefail

if [[ $EUID -ne 0 ]]; then
    echo "error: must be run as root (writing to /etc/customsso-manager/)" >&2
    exit 1
fi

TOKEN_FILE=/etc/customsso-manager/first-run.token
DB_CREDS=/etc/customsso-manager/db.creds

if [[ ! -r "$DB_CREDS" ]]; then
    echo "error: cannot read $DB_CREDS — is customsso-manager actually installed on this host?" >&2
    exit 2
fi
# shellcheck disable=SC1090
. "$DB_CREDS"

USER_COUNT=$(mysql -N -u"$DB_USER" -p"$DB_PASS" "$DB_NAME" -e "SELECT COUNT(*) FROM users")
if [[ "$USER_COUNT" -gt 0 ]]; then
    cat >&2 <<EOF
error: refusing to regenerate the setup token — the users table already has
$USER_COUNT row(s). The boot-token flow is only intended for a truly-fresh
install.

If you've lost access to every admin account and password recovery isn't
available (no email configured, or all users have unset emails), you'll
need to reset an admin's password directly in the DB:

    UPDATE users SET pwhash = '<bcrypt-hash>' WHERE username = '<u>';

Use php -r 'echo password_hash("newpass", PASSWORD_DEFAULT);' to generate
the bcrypt hash.
EOF
    exit 3
fi

TOKEN=$(openssl rand -hex 32)   # portable — openssl is pulled by mod_ssl on OL9
echo "$TOKEN" > "$TOKEN_FILE"
chown root:apache "$TOKEN_FILE"
chmod 660 "$TOKEN_FILE"

# Best-effort URL — from Apache vhost's ServerName if we can find it, else
# fall back to the machine's hostname.
HOST=$(awk '/^\s*ServerName/ {print $2; exit}' /etc/httpd/conf.d/customsso-manager.conf 2>/dev/null || true)
[[ -z "$HOST" ]] && HOST=$(hostname)

cat <<EOF

  New first-run setup token generated.

  Open in a browser:
    https://$HOST/setup?token=$TOKEN

  Token also stored at $TOKEN_FILE.

EOF