#!/usr/bin/env bash
# policy: usr_scan-notify — scan alert notification daemon for IPA group members.
# When the usr_scan-notify user group exists: installs a systemd fetch-alerts timer
# (fleet-wide) and a profile.d snippet that starts the notification daemon on login
# for group members (checked at login time via id/SSSD).

FETCH_SVC="/etc/systemd/system/ansipa-fetch-alerts.service"
FETCH_TIMER="/etc/systemd/system/ansipa-fetch-alerts.timer"
NOTIFY_PROFILED="/etc/profile.d/ansipa-notify.sh"

if [[ "$WANT_SCAN_NOTIFY" == true ]]; then
    if [[ ! -x /usr/local/bin/ansipa-fetch-alerts.sh ]]; then
        warn "ansipa-fetch-alerts.sh not found — run deploy-ansipa-policies.yml first."
    fi

    if [[ ! -f "$FETCH_SVC" ]]; then
        log "Installing ansipa-fetch-alerts systemd service + timer"
        cat > "$FETCH_SVC" <<'UNIT'
[Unit]
Description=Fetch Ansipa security alerts from the server SMB share
After=network-online.target sssd.service
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/ansipa-fetch-alerts.sh
StandardOutput=journal
StandardError=journal
UNIT

        cat > "$FETCH_TIMER" <<'UNIT'
[Unit]
Description=Periodic ansipa security alert fetch

[Timer]
OnBootSec=2min
OnUnitActiveSec=10min

[Install]
WantedBy=timers.target
UNIT
        systemctl daemon-reload
        systemctl enable --now ansipa-fetch-alerts.timer
        log "ansipa-fetch-alerts.timer enabled"
    fi

    if [[ ! -f "$NOTIFY_PROFILED" ]]; then
        log "Installing /etc/profile.d/ansipa-notify.sh"
        cat > "$NOTIFY_PROFILED" <<'PROFILED'
# ansipa-notify: launch the scan alert notification daemon on login for
# members of the usr_scan-notify FreeIPA user group.
# Managed by ansipa-enforce-policies — do not edit manually.
_NOTIFY_DAEMON=/usr/local/bin/ansipa-scan-notify.sh
if [[ -x "$_NOTIFY_DAEMON" ]] && \
   id -nG 2>/dev/null | grep -qw "usr_scan-notify" && \
   ! pgrep -u "$(id -u)" -f "ansipa-scan-notify" >/dev/null 2>&1; then
    "$_NOTIFY_DAEMON" &
    disown
fi
unset _NOTIFY_DAEMON
PROFILED
        chmod 644 "$NOTIFY_PROFILED"
    fi
else
    if [[ -f "$FETCH_TIMER" ]]; then
        systemctl disable --now ansipa-fetch-alerts.timer 2>/dev/null || true
        rm -f "$FETCH_SVC" "$FETCH_TIMER"
        systemctl daemon-reload
        log "Removed ansipa-fetch-alerts timer (usr_scan-notify user group no longer exists)"
    fi
    if [[ -f "$NOTIFY_PROFILED" ]]; then
        rm -f "$NOTIFY_PROFILED"
        log "Removed /etc/profile.d/ansipa-notify.sh"
    fi
fi