#!/bin/bash
# postinst script for imunify-antivirus
set -e
is_imunify360_installed()
{
    test -f /var/imunify360/.i360
    return $?
}

regenerate_config_example()
{
    # re-generate imunify360.config.defaults.example from schema defaults
    /opt/imunify360/venv/share/imunify360/scripts/create_default_config \
    /etc/sysconfig/imunify360/imunify360.config.defaults.example
    chmod 0600 /etc/sysconfig/imunify360/imunify360.config.defaults.example
}

generate_merge_config_if_not_exists()
{
    merged_config=/etc/sysconfig/imunify360/imunify360-merged.config
    [[ ! -f $merged_config ]] && cat /etc/sysconfig/imunify360/imunify360.config.defaults.example > $merged_config || true
}

case "$1" in
    configure)
        rm -f /var/lib/rpm-state/imunify360-transaction-in-progress

        # DEF-43978: On IM360+AV hosts, an AV-only upgrade leaves
        # imunify360-agent.* in `inactive (ConditionResult=no)`. The Debian
        # equivalent of imunify360-firewall.spec's %triggerun runs `systemctl
        # restart` while the transaction lock is still present; the start
        # half hits ConditionPathExists and the unit goes to condition-skipped.
        # Nothing in the remaining scriptlet chain recovers it. Do that here,
        # now that the lock above is removed.
        if is_imunify360_installed
        then
            /bin/systemctl reset-failed \
                imunify360.service \
                imunify360-agent.service \
                imunify360-agent.socket \
                imunify360-agent-user.socket >/dev/null 2>&1 || :
            /bin/systemctl start \
                imunify360-agent.socket \
                imunify360-agent-user.socket >/dev/null 2>&1 || :
        fi

        # don't start AV service if IM360 is used
        if ! is_imunify360_installed
        then
            /bin/systemctl daemon-reload --no-block >/dev/null 2>&1 || :
            # will be enabled later, during imunify agent registration
            #/bin/systemctl disable imunify-antivirus.service >/dev/null 2>&1 || :
            if /bin/systemctl is-enabled imunify-antivirus.service >/dev/null
            then
                /bin/systemctl start imunify-antivirus.service >/dev/null
            fi
            regenerate_config_example
            if [ ! -e /etc/sysconfig/imunify360/imunify360-merged.config ]
            then
              # to pervent possible failures other products that might use imunify360-merged.config
              cp /etc/sysconfig/imunify360/imunify360.config.defaults.example /etc/sysconfig/imunify360/imunify360-merged.config
            fi
            if [ ! -e /etc/sysconfig/imunify360/imunify360.config ]
            then
              # create empty config file to allow
              cp /dev/null /etc/sysconfig/imunify360/imunify360.config
            fi
            # to allow malware scans by modsec
            chmod 644 /etc/sysconfig/imunify360/imunify360-merged.config
            ln -svf /usr/bin/imunify-antivirus /usr/bin/imunify360-agent
            systemctl enable imunify-antivirus.service && \
            systemctl enable imunify-antivirus.socket && \
            systemctl enable imunify-antivirus-user.socket && \
            systemctl enable imunify-antivirus-sensor.socket && \
            systemctl daemon-reload --no-block >/dev/null 2>&1 || :
            systemctl start imunify-antivirus-sensor.socket && \
            systemctl start imunify-antivirus.socket && \
            systemctl start imunify-antivirus-user.socket
        fi
        chmod 01777 /var/log/imunify360_user_logs
        chmod 0600 /var/imunify360/uploads
        chmod 0600 /opt/imunify360/venv/share/imunify360/10_on_first_install_av.config
        chmod 0600 /opt/imunify360/venv/share/imunify360/10_plesk_default_av.config
        chmod 0600 /opt/imunify360/venv/share/imunify360/11_on_first_install_wp_av.config
        chmod 0700 /var/imunify360/tmp
        chmod 0750 /var/imunify360/tmp_cleanup
        chmod 0775 /var/imunify360/files
        chmod 0770 /opt/imunify360/venv/share/imunify360/scripts/send-notifications
        chmod 0755 /var/imunify360/aibolit
        chmod 0700 /var/imunify360/aibolit/run
        chmod 0700 /var/imunify360/aibolit/resident/in/notify-jobs
        chmod 0700 /var/imunify360/aibolit/resident/out
        chown root:root /opt/imunify360/venv/share/imunify360/10_on_first_install_av.config
        chown root:root /opt/imunify360/venv/share/imunify360/10_plesk_default_av.config
        chown root:root /opt/imunify360/venv/share/imunify360/11_on_first_install_wp_av.config
        chown root:root /var/imunify360/files
        chown root:root /var/imunify360/tmp
        chown root:root /var/imunify360/tmp_cleanup
        chown root:root /var/imunify360/uploads
        chown root:root /var/log/imunify360_user_logs
        chown root:root /var/imunify360/aibolit
        chown root:root /var/imunify360/aibolit/run
        chown root:root /var/imunify360/aibolit/resident/in/notify-jobs
        chown root:root /var/imunify360/aibolit/resident/out
        chown root:_imunify /opt/imunify360/venv/share/imunify360/scripts/send-notifications

        # make readable for non-root services
        id _imunify &>/dev/null || useradd --system -U -d /dev/null _imunify || true
        chmod 2755 /var/imunify360/
        chown :_imunify /var/imunify360
        chown :_imunify /var/imunify360/tmp_cleanup
        chown :_imunify /var/imunify360/imunify360.db* || true

        # make executable with root rights for non-root user
        chmod u+s /opt/imunify360/venv/share/imunify360/scripts/send-notifications

    ;;
    triggered)
        # should be triggered on imunify360-firewall (un)install/update
        regenerate_config_example
        if is_imunify360_installed
        then
            # mask imunify-antivirus service to prevent it from starting
            /bin/systemctl stop imunify-antivirus.service >/dev/null
            /bin/systemctl mask imunify-antivirus.service >/dev/null
            # fill imunify360-merged.config with defaults,
            # the agent must specify the actual settings at startup
            generate_merge_config_if_not_exists
        else
            /bin/systemctl unmask imunify-antivirus.service >/dev/null
            /bin/systemctl restart imunify-antivirus.service >/dev/null
        fi
    ;;
    abort-upgrade|abort-remove|abort-deconfigure)
    ;;
    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac
exit 0