manage

#!/bin/bash
export MSYS_NO_PATHCONV=1
# getDockerHost; for details refer to https://github.com/bcgov/DITP-DevOps/tree/main/code/snippets#getdockerhost
. /dev/stdin <<<"$(cat <(curl -s --raw https://raw.githubusercontent.com/bcgov/DITP-DevOps/main/code/snippets/getDockerHost))" 
export DOCKERHOST=$(getDockerHost)
set -e

function echoError (){
  _msg=${1}
  _red='\e[31m'
  _nc='\e[0m' # No Color
  echo -e "${_red}${_msg}${_nc}"
}

function echoWarning (){
  _msg=${1}
  _yellow='\e[33m'
  _nc='\e[0m' # No Color
  echo -e "${_yellow}${_msg}${_nc}"
}

function echoSuccess (){
  _msg=${1}
  _green='\e[32m'
  _nc='\e[0m' # No Color
  echo -e "${_green}${_msg}${_nc}"
}

function echoInfo (){
  _msg=${1}
  _gray='\e[36m'
  _nc='\e[0m' # No Color
  echo -e "${_gray}${_msg}${_nc}"
}

function generateKey(){
  (
    _length=${1:-48}
    # Format can be `-base64` or `-hex`
    _format=${2:--base64}

    echo $(openssl rand ${_format} ${_length})
  )
}

function generateSeed(){
  (
    _prefix=${1}
    _seed=$(echo "${_prefix}$(generateKey 32)" | fold -w 32 | head -n 1 )
    _seed=$(echo -n "${_seed}")
    echo ${_seed}
  )
}

SCRIPT_HOME="$(cd "$(dirname "$0")" && pwd)"

# =================================================================================================================
# Usage:
# -----------------------------------------------------------------------------------------------------------------
usage() {
  cat <<-EOF
    
      Usage: $0 [command] [options]
    
      Commands:
    
      build - Build the docker images for the project.
              You need to do this first.
    
                $0 build 
    
      up -  Creates the application containers from the built images
            and starts the services based on the docker-compose.yml file.

            You can pass in a list of containers to start.  
            By default all containers will be started.

              $0 start

      start - Same as up.

      logs - Display the logs from the docker compose run (ctrl-c to exit).

      stop - Stops the services.  This is a non-destructive process.  The volumes and containers
             are not deleted so they will be reused the next time you run start.
    
      down - Brings down the services and removes the volumes (storage) and containers.
      
      rm - Same as down
EOF
  exit 1
}

# -----------------------------------------------------------------------------------------------------------------
# Default Settings:
# -----------------------------------------------------------------------------------------------------------------
DEFAULT_CONTAINERS="keycloak keycloak-db controller-db"
ACAPY_CONTAINERS="aca-py wallet-db"
PROD_CONTAINERS="controller"

# -----------------------------------------------------------------------------------------------------------------
# Functions:
# -----------------------------------------------------------------------------------------------------------------
build-oidc-controller() {
  #
  # oidc-controller
  #
  echo -e "\nBuilding oidc-controller image..."
  docker build \
    -t 'vc-authn-oidc-controller' \
    -f './oidc-controller/Dockerfile' '..'
}

buildImages() {
  build-oidc-controller
}

configureEnvironment() {

  if [ -f .env ]; then
    while read line; do
      if [[ ! "$line" =~ ^\# ]] && [[ "$line" =~ .*= ]]; then
        export ${line//[$'\r\n']}
      fi
    done <.env
  fi

   for arg in "$@"; do
    # Remove recognized arguments from the list after processing.
    shift

    # echo "arg: ${arg}"
    # echo "Remaining: ${@}"

    case "$arg" in
      *=*)
        # echo "Exporting ..."
        export "${arg}"
        ;;
      *)
        # echo "Saving for later ..."
        # If not recognized, save it for later procesing ...
        set -- "$@" "$arg"
        ;;
    esac
  done

  ## global
  export COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-vc-authn}"
  export LOG_LEVEL=${LOG_LEVEL:-"DEBUG"}

  # controller-db
  export MONGODB_HOST="controller-db"
  export MONGODB_PORT="27017"
  export MONGODB_NAME="oidccontroller"
  export OIDC_CONTROLLER_DB_USER="oidccontrolleruser"
  export OIDC_CONTROLLER_DB_USER_PWD="oidccontrollerpass"


  # controller
  export CONTROLLER_SERVICE_PORT=${CONTROLLER_SERVICE_PORT:-5000}
  export CONTROLLER_URL="${CONTROLLER_URL:-http://controller:5000}"
  export CONTROLLER_WEB_HOOK_URL=${CONTROLLER_WEB_HOOK_URL:-${CONTROLLER_URL}/webhooks}
  if [ ! -z "${CONTROLLER_API_KEY}" ]; then
    CONTROLLER_WEB_HOOK_URL="${CONTROLLER_WEB_HOOK_URL}#${CONTROLLER_API_KEY}"
  fi
  export ST_ACAPY_ADMIN_API_KEY_NAME="x-api-key"

  # The redirect url can be a web link or the name of a template
  export CONTROLLER_CAMERA_REDIRECT_URL="wallet_howto"

  # The number of time in seconds a proof request will be valid for
  export CONTROLLER_PRESENTATION_EXPIRE_TIME=10

  # How long auth_sessions with matching the states in
  # CONTROLLER_SESSION_TIMEOUT_CONFIG_FILE are stored for in seconds
  export CONTROLLER_PRESENTATION_CLEANUP_TIME=86400

  # The path to the auth_session timeouts config file
  export CONTROLLER_SESSION_TIMEOUT_CONFIG_FILE="/etc/controller-config/sessiontimeout.json"

  # Extend Variable Substitutions
  export CONTROLLER_VARIABLE_SUBSTITUTION_OVERRIDE="/etc/controller-config/user_variable_substitution.py"

  #controller app settings
  export INVITATION_LABEL=${INVITATION_LABEL:-"VC-AuthN"}
  export SET_NON_REVOKED="True"
  export USE_OOB_PRESENT_PROOF=${USE_OOB_PRESENT_PROOF:-"true"}
  export USE_OOB_LOCAL_DID_SERVICE=${USE_OOB_LOCAL_DID_SERVICE:-"true"}
  export USE_URL_DEEP_LINK=${USE_URL_DEEP_LINK:-"false"}
  export WALLET_DEEP_LINK_PREFIX=${WALLET_DEEP_LINK_PREFIX:-"bcwallet://aries_proof-request"}

  # agent
  export AGENT_TENANT_MODE="${AGENT_TENANT_MODE:-single}"
  export AGENT_HOST=${AGENT_HOST:-aca-py}
  export AGENT_NAME="VC-AuthN Agent"
  export AGENT_HTTP_PORT=${AGENT_HTTP_PORT:-8030}
  export AGENT_ADMIN_PORT=${AGENT_ADMIN_PORT:-"8077"}
  export AGENT_ADMIN_URL=${AGENT_ADMIN_URL:-http://$AGENT_HOST:$AGENT_ADMIN_PORT}
  export AGENT_ENDPOINT=${AGENT_ENDPOINT:-http://$AGENT_HOST:$AGENT_HTTP_PORT}
  export AGENT_ADMIN_API_KEY=${AGENT_ADMIN_API_KEY}
  export AGENT_ADMIN_MODE="admin-insecure-mode"
  if [ ! -z "${AGENT_ADMIN_API_KEY}" ]; then
    AGENT_ADMIN_MODE="admin-api-key ${AGENT_ADMIN_API_KEY}"
  fi
  export AGENT_WALLET_SEED=${AGENT_WALLET_SEED}
  export MT_ACAPY_WALLET_ID=${MT_ACAPY_WALLET_ID}
  export MT_ACAPY_WALLET_KEY=${MT_ACAPY_WALLET_KEY}

  # keycloak-db
  export KEYCLOAK_DB_NAME="keycloak"
  export KEYCLOAK_DB_USER="keycloak"
  export KEYCLOAK_DB_PASSWORD="keycloak"

  # keycloak
  export KEYCLOAK_DB_VENDOR="postgres"
  export KEYCLOAK_DB_ADDR="keycloak-db"
  export KEYCLOAK_USER="admin"
  export KEYCLOAK_PASSWORD="admin"
  export KEYCLOAK_LOGLEVEL="WARN"
  export KEYCLOAK_ROOT_LOGLEVEL="WARN"

  # wallet-db
  export WALLET_TYPE="postgres_storage"
  export WALLET_ENCRYPTION_KEY="key"
  export POSTGRESQL_WALLET_HOST="wallet-db"
  export POSTGRESQL_WALLET_PORT="5432"
  export POSTGRESQL_WALLET_DATABASE="wallet_db"
  export POSTGRESQL_WALLET_USER="walletuser"
  export POSTGRESQL_WALLET_PASSWORD="walletpassword"
}

getStartupParams() {
  CONTAINERS=""
  ARGS="--force-recreate"

  for arg in $@; do
    case "$arg" in
    *=*)
      # Skip it
      ;;
    -*)
      ARGS+=" $arg"
      ;;
    *)
      CONTAINERS+=" $arg"
      ;;
    esac
  done

  if [ -z "$CONTAINERS" ]; then
    CONTAINERS="$DEFAULT_CONTAINERS"
  fi

  echo ${ARGS} ${CONTAINERS}
}

deleteVolumes() {
  _projectName=${COMPOSE_PROJECT_NAME:-vc-authn}

  echo "Stopping and removing any running containers ..."
  docker-compose -f docker-compose.yaml -f docker-compose-ngrok.yaml down -v

  _pattern="^${_projectName}_\|^docker_"
  _volumes=$(docker volume ls -q | grep ${_pattern})

  if [ ! -z "${_volumes}" ]; then
    echo "Removing project volumes ..."
    echo ${_volumes} | xargs docker volume rm
  else
    echo "No project volumes exist."
  fi
}

toLower() {
  echo $(echo ${@} | tr '[:upper:]' '[:lower:]')
}

initializeUserPrompts() {
  ######
  #  If .env-dev exists, use it to populate .env
  #  Otherwise, create an empty .env file
  if [ -f ".env-dev" ] ; then
    cat .env-dev > .env
    echo "" >> .env
  else
    touch .env
  fi
  ######

  echo "AGENT_WALLET_SEED=$(generateSeed vc-authn-oidc)" >> .env
  startNgrokContainers
  setNgrokEndpoints
}

# starts ngrok proxies for controller and, when in single-tenant mode, for the agent
function startNgrokContainers() {
  #  start ngrok container first so we can grab the tunnel URLs
  echo "Starting ngrok container..."
  COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-vc-authn}" docker compose -f docker-compose-ngrok.yaml up -d --force-recreate
}

# This function verifies if the controller and agent URLs are already set. If they are not set,
# it retrieves and assigns the ngrok endpoints for both the controller and agent services.
# This enables remote access to these services for the current session.
function setNgrokEndpoints() {
  if [ -n "$CONTROLLER_URL" ]; then
    echo "CONTROLLER_URL is already set to: $CONTROLLER_URL"
  else
    echoInfo "Determining ngrok url for controller service..."
    
    getNgrokUrl http://${DOCKERHOST}:4046/api/tunnels controller-ngrok.json NGROK_CONTROLLER_URL controller-ngrok
    export CONTROLLER_URL=${NGROK_CONTROLLER_URL}
    
    echoSuccess "The controller url is: ${NGROK_CONTROLLER_URL}"
  fi

  if [ -n "$AGENT_ENDPOINT" ]; then
    echo "AGENT_ENDPOINT is already set to: $AGENT_ENDPOINT"
  else
    echoInfo "Determining ngrok url for agent service..."
    getNgrokUrl http://${DOCKERHOST}:4046/api/tunnels agent-ngrok.json NGROK_AGENT_URL aca-py-ngrok
    
    export AGENT_ENDPOINT=${NGROK_AGENT_URL}
    
    echoSuccess "The agent url is: ${NGROK_AGENT_URL}"
  fi
}

function getNgrokUrl() {
  _url=$1
  _output_file=$2
  _target_variable=$3
  _tunnel_name=$4

  function extractUrl() {
    docker run --rm curlimages/curl -L -s $_url > $_output_file
    NGROK_URL=$(docker run --rm -i ghcr.io/jqlang/jq:1.7rc1 < $_output_file --raw-output '.tunnels | map(select(.name=="'${_tunnel_name}'")) | .[0] | .public_url')
  
    if [ -z "${NGROK_URL}" ] || [ "null" = "${NGROK_URL}" ]; then
      return 1
    else
      return 0
    fi
  }

  local startTime=${SECONDS}
  local timeout=${TIMEOUT:-60}
  while ! extractUrl; do
    printf "."
    local duration=$(($SECONDS - $startTime))
    if (( ${duration} >= ${timeout} )); then
      echoError "It was not possible to establish a connection with ngrok, please check ${_output_file} and the ngrok container logs for errors."
      rtnCd=1
      break
    fi
    sleep 1
  done
  
  rm $_output_file

  # assign value to target variable
  printf -v "$_target_variable" "%s" "$NGROK_URL"
}

# =================================================================================================================

pushd ${SCRIPT_HOME} >/dev/null
COMMAND=$(toLower ${1})
shift || COMMAND=usage

case "${COMMAND}" in
start|up)
  _startupParams=$(getStartupParams $@)
  
  if [[ ! -f ".env" ]]; then
    # first/clean run, prompt user selections
    initializeUserPrompts
    echoWarning "User preferences were saved in docker/.env for future use"
  else
    # ngrok was already chosen, refresh containers/endpoints
    echoInfo "Refreshing ngrok containers..."
    startNgrokContainers
    setNgrokEndpoints
  fi

  configureEnvironment $@

  docker-compose up -d ${_startupParams} ${DEFAULT_CONTAINERS} ${ACAPY_CONTAINERS} ${PROD_CONTAINERS}

  docker-compose logs -f
 ;;
logs)
  configureEnvironment $@
  docker-compose logs -f
  ;;
stop)
  configureEnvironment
  docker-compose stop
  docker compose -f docker-compose-ngrok.yaml stop
  ;;
rm|down)  
  # delete previously saved settings
  if [ -f ".env" ] ; then
    rm ".env"
  fi

  configureEnvironment
  deleteVolumes
  ;;
build)
  _startupParams=$(getStartupParams $@)
  configureEnvironment $@
  buildImages
  ;;
*)
  usage
  ;;
esac

popd >/dev/null