#!/usr/bin/env bash
# ./gl-inet-enable-ssh.sh <password> [router-ip]
#
# Defaults to 192.168.8.1. It does:
#
# 1. Completes OOBE/init (sets password + enables SSH)
# 2. Challenge-response login
# 3. Explicitly enables SSH via API
# 4. Verifies SSH is working
#
# Needs curl, python3, openssl, sshpass, and md5sum on the machine running it.

set -euo pipefail

ROUTER="${GL_ROUTER:-192.168.8.1}"
PASSWORD="${1:?Usage: $0 <password> [router-ip]}"
HOST="${2:-$ROUTER}"

challenge() {
  curl -sk "http://$HOST/rpc" \
    -H "Content-Type: application/json" \
    -d "{\"jsonrpc\":\"2.0\",\"method\":\"challenge\",\"params\":{\"username\":\"root\"},\"id\":1}"
}

login() {
  local hash="$1"
  curl -sk "http://$HOST/rpc" \
    -H "Content-Type: application/json" \
    -d "{\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"username\":\"root\",\"hash\":\"$hash\"},\"id\":2}"
}

rpc_call() {
  local sid="$1" module="$2" method="$3" params="$4"
  curl -sk "http://$HOST/rpc" \
    -H "Content-Type: application/json" \
    -d "{\"jsonrpc\":\"2.0\",\"method\":\"call\",\"params\":[\"$sid\",\"$module\",\"$method\",$params],\"id\":3}"
}

# Step 1: Complete OOBE / init (enables SSH)
echo "Initializing router..."
INIT=$(curl -sk "http://$HOST/rpc" \
  -H "Content-Type: application/json" \
  -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"call\",\"params\":[\"\",\"ui\",\"init\",{\"lang\":\"en\",\"username\":\"root\",\"password\":\"$PASSWORD\",\"security_rule\":0}]}")
echo "$INIT"

if echo "$INIT" | grep -q '"error"'; then
  echo "Init returned error (may already be initialized), continuing..."
fi

sleep 1

# Step 2: Challenge-response login
echo "Logging in..."
CHALLENGE=$(challenge)
SALT=$(echo "$CHALLENGE" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['salt'])")
NONCE=$(echo "$CHALLENGE" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['nonce'])")
ALG=$(echo "$CHALLENGE" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['alg'])")

CIPHER=$(openssl passwd "-$ALG" -salt "$SALT" "$PASSWORD" 2>/dev/null)
HASH=$(printf "root:%s:%s" "$CIPHER" "$NONCE" | md5sum | cut -d' ' -f1)

LOGIN=$(login "$HASH")
SID=$(echo "$LOGIN" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['sid'])" 2>/dev/null)

if [ -z "$SID" ]; then
  echo "Login failed: $LOGIN"
  echo "SSH should still be enabled from the init call. Try: ssh root@$HOST"
  exit 1
fi

echo "Logged in. SID: $SID"

# Step 3: Enable SSH explicitly
echo "Enabling SSH..."
SSH_RESULT=$(rpc_call "$SID" "system" "set_settings" '{"key":"ssh","value":{"enable":true}}')
echo "$SSH_RESULT"

# Step 4: Verify SSH
echo "Verifying SSH on $HOST:22..."
if sshpass -p "$PASSWORD" ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no root@$HOST "echo SSH OK" 2>/dev/null; then
  echo "Done. SSH is enabled on root@$HOST"
else
  echo "SSH port not responding yet. May need a moment or SSH may already be enabled."
  echo "Try: ssh root@$HOST"
fi