#!/bin/sh
## First-boot bootstrapper for logrus-client.
##
## Reads account credentials from UCI and runs `logrus-client login` to
## seed /etc/logrus/session.json. Idempotent: skipped if a session
## already exists, so a re-flash that preserves /etc/ doesn't double-login.
##
## OpenWrt removes the script from /etc/uci-defaults/ after a successful
## (exit 0) run, so this file is one-shot.

set -e

STATE_DIR=/etc/logrus
SESSION="$STATE_DIR/session.json"

if [ -s "$SESSION" ]; then
	logger -t logrus "session already present, skipping first-boot login"
	exit 0
fi

. /lib/functions.sh
config_load logrus

account=""
passphrase=""
user_server=""
config_get account     main account
config_get passphrase  main passphrase
config_get user_server main user_server 'https://logrus.space/api'

if [ -z "$account" ] || [ -z "$passphrase" ]; then
	logger -t logrus "no account/passphrase in /etc/config/logrus — skipping" \
		"first-boot login; run 'logrus-client login' manually or set them" \
		"and reboot"
	# Exit 0 so uci-defaults removes the script anyway; manual login is
	# expected on routers where the operator preferred to set credentials
	# over SSH after install.
	exit 0
fi

mkdir -p "$STATE_DIR"
chmod 0700 "$STATE_DIR"

LOGRUS_USER_SERVER="$user_server" LOGRUS_CLIENT_HOME="$STATE_DIR" \
	/usr/sbin/logrus-client login \
		--account "$account" \
		--passphrase "$passphrase" \
		--label "openwrt-$(cat /proc/sys/kernel/hostname)" \
	>/tmp/logrus-login.log 2>&1 || {
	logger -t logrus "first-boot login failed; see /tmp/logrus-login.log"
	exit 0
}

# Successful login — clear the credentials from UCI so they don't sit
# in /etc/config/logrus in plaintext after they've served their purpose.
# The session token in /etc/logrus/session.json supersedes them.
uci -q set logrus.main.account=''
uci -q set logrus.main.passphrase=''
uci commit logrus

logger -t logrus "first-boot login complete; session stored under $STATE_DIR"
exit 0
