#!/usr/bin/env bash
set -Eeuo pipefail
# Run as root once per boot. NEVER write to internal devices.
DATA=/mnt/intake-data
if ! id intake &>/dev/null; then
  useradd --create-home --home-dir /home/intake --shell /bin/bash --user-group intake
fi
install -d -o intake -g intake -m 0700 /home/intake
# Read protected DMI fields once as root; provide a boot-local, read-only snapshot.
install -d -o root -g intake -m 0750 /run/csr-intake
for field in product_uuid product_serial; do
  if [[ -r /sys/class/dmi/id/$field ]]; then
    install -o root -g intake -m 0440 "/sys/class/dmi/id/$field" "/run/csr-intake/$field"
  fi
done
if [[ -r /sys/firmware/dmi/tables/DMI ]]; then
  install -o root -g intake -m 0440 /sys/firmware/dmi/tables/DMI /run/csr-intake/DMI
fi
install -d -m 0755 "$DATA"
part=$(blkid -L INTAKE_DATA || true)
if [[ -z "$part" ]]; then
  echo 'CS-R ERROR: INTAKE_DATA not found; scans must not run.' >&2
else
  if ! mountpoint -q "$DATA"; then
    mount -o rw,nosuid,nodev "$part" "$DATA"
  fi
  for d in config database reports checklists inspections final-reports diagnostics; do
    mkdir -p "$DATA/$d"
    chown -R intake:intake "$DATA/$d"
  done
  chown intake:intake "$DATA"
  [[ ! -f "$DATA/active-inspection.txt" ]] || chown intake:intake "$DATA/active-inspection.txt"
  chmod 0750 "$DATA"
  # Only provision when absent; the user can rotate credentials on persistent media.
  if [[ -d /etc/csr-intake ]]; then
    for f in inventory.json inventory-api-key workshop.json; do
      if [[ -f /etc/csr-intake/$f && ! -e "$DATA/config/$f" ]]; then
        install -o intake -g intake -m 0600 "/etc/csr-intake/$f" "$DATA/config/$f"
      fi
    done
  fi
  [[ ! -f "$DATA/config/inventory-api-key" ]] || chmod 0600 "$DATA/config/inventory-api-key"
  # Workshop TLS certificates stay on persistent media, alongside inventory config.
  # Preserve certificate and hostname verification for Python and curl.
  if [[ -f "$DATA/config/inventory-server.crt" ]]; then
    install -D -m 0644 "$DATA/config/inventory-server.crt" /etc/ca-certificates/trust-source/anchors/csr-inventory.crt
    update-ca-trust
  fi
fi
install -o intake -g intake -m 0644 /usr/local/bin/intake-login /home/intake/.bash_profile
# .bash_profile sourced by the user's real console login.