#!/bin/sh
# ==============================================================================
# Elastic Stack Comprehensive Certificate Expiry Checker Wrapper
# ==============================================================================

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
PYTHON_SCRIPT="$SCRIPT_DIR/check-cert-expiry.py"

if command -v python3 >/dev/null 2>&1 && [ -f "$PYTHON_SCRIPT" ]; then
  exec python3 "$PYTHON_SCRIPT" "$@"
fi

# Fallback POSIX sh implementation
set -eu

echo ""
echo "===================================================================================="
echo " Elastic Stack Comprehensive Certificate Expiry Checker"
echo "===================================================================================="
echo ""

ES_CONFIG="${1:-/etc/elasticsearch/elasticsearch.yml}"
KIBANA_CONFIG="${2:-/etc/kibana/kibana.yml}"

parse_yaml_certs() {
  cfg="$1"
  [ -f "$cfg" ] || return 0
  base=$(dirname "$cfg")
  grep -E -i "^\s*[^#].*(ssl|cert|key|keystore|truststore|ca)" "$cfg" 2>/dev/null | while read -r line; do
    key=$(echo "$line" | cut -d: -f1 | sed 's/^[ \t]*//')
    val=$(echo "$line" | cut -d: -f2- | sed -E "s/^[ \t\"'\-]+//;s/[ \t\"']+$//;s/#.*$//")
    if [ -n "$val" ] && [ "$val" != "true" ] && [ "$val" != "false" ]; then
      case "$val" in
        /*) echo "$key:$val" ;;
        *) echo "$key:$base/$val" ;;
      esac
    fi
  done
}

get_cert_enddate() {
  f="$1"
  [ -f "$f" ] || { echo "File not found"; return 0; }
  [ -r "$f" ] || { echo "Permission denied"; return 0; }
  
  dt=""
  case "$f" in
    *.p12|*.pfx)
      dt=$(openssl pkcs12 -in "$f" -passin pass: -nokeys 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2 || true)
      ;;
    *)
      dt=$(openssl x509 -in "$f" -noout -enddate 2>/dev/null | cut -d= -f2 || true)
      ;;
  esac
  echo "${dt:-Unable to parse / Password protected}"
}

printf "%-40s %-45s %s\n" "SOURCE / CONFIG KEY" "FILE PATH" "VALID UNTIL (EXPR)"
echo "-------------------------------------------------------------------------------------------------------------------"

# Parse ES and Kibana configs
for cfg in "$ES_CONFIG" "$KIBANA_CONFIG"; do
  if [ -f "$cfg" ]; then
    parse_yaml_certs "$cfg" | while IFS=: read -r k p; do
      dt=$(get_cert_enddate "$p")
      printf "%-40s %-45s %s\n" "$(basename "$cfg") [$k]" "$p" "$dt"
    done
  fi
done

# Standard default paths across versions
for p in /etc/elasticsearch/certs/http.p12 /etc/elasticsearch/certs/transport.p12 /etc/elasticsearch/certs/http_ca.crt /etc/elasticsearch/elastic-certificates.p12 /etc/elasticsearch/ca/ca.crt /etc/kibana/certs/kibana.crt /etc/kibana/kibana.crt; do
  dt=$(get_cert_enddate "$p")
  printf "%-40s %-45s %s\n" "Standard Fallback Path" "$p" "$dt"
done
echo ""