awx-credential-modify

#!/bin/bash

# This script comes with ABSOLUTELY NO WARRANTY, use at own risk
# Copyright (C) 2020 Osiris Alejandro Gomez <osiris@gcoop.coop>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.

# shellcheck disable=SC1090
# shellcheck disable=SC1091
# shellcheck source=/dev/null
# shellcheck disable=SC2086
# shellcheck disable=SC2181

DIR_BIN="$(dirname "$0")" && source "$DIR_BIN/awx-common"

function usage()
{
cat << EOF
Usage:

\`\`\`bash

  $BIN CREDENTIAL_NAME [SSH_KEY_DATA] [SSH_KEY_UNLOCK]

\`\`\`

Modify a _credential_ as _Machine_ type by default.

Examples:

  Get _ssh private key_ and _passphrase_ from \`pass\`:

  \`\`\`bash

    $BIN ansible_test

    == ============ ===============
    id    name      credential_type
    == ============ ===============
    26 ansible_test               1
    == ============ ===============

  \`\`\`

  Get _ssh private key_ without _passphrase_ from file:

  \`\`\`bash

    $BIN ansible_test ~/.ssh/ansible_test

  \`\`\`

  Get _ssh private key_ from file and _passphrase_ as argument:

  \`\`\`bash

    $BIN ansible_test ~/.ssh/ansible_test 'super mega secret'

  \`\`\`

EOF
exit 0
}

[[ "$1" =~ ^[-]+(h|help) ]] && usage

[[ -z "$1" ]] && die "EMPTY CREDENTIAL NAME"
CREDENTIAL="$1"

ID="$(awx-cli credential get -n "$CREDENTIAL" -f id)"
[[ -z "$ID"                      ]] && die "NOT FOUND CREDENTIAL $CREDENTIAL"

[[ -z "$DEFAULT_ORGANIZATION"    ]] || ORGANIZATION="$DEFAULT_ORGANIZATION"
[[ -z "$DEFAULT_CREDENTIAL_TYPE" ]] || CREDENTIAL_TYPE="$DEFAULT_CREDENTIAL_TYPE"
[[ -z "$DEFAULT_CREDENTIAL_USER" ]] || CRED_USER="$DEFAULT_CREDENTIAL_USER"
[[ -z "$CREDENTIAL_TYPE"         ]] && die "UNDEFINED CREDENTIAL_TYPE"

export PASSWORD_STORE_DIR="$PASSWORD_STORE_DIR"
TMP="$(mktemp)"

if [[ -z "$2" ]]
then

  PASS_CRED_PREFIX="${PASS_PREFIX}credential/$CREDENTIAL"
  PASS_KEY_DATA="${PASS_CRED_PREFIX}/ssh_key_data"
  PASS_KEY_UNLOCK="${PASS_CRED_PREFIX}/ssh_key_unlock"
  PASS_KEY_USER="${PASS_CRED_PREFIX}/username"

  pass "$PASS_KEY_DATA" > "$TMP" && chmod 0600 "$TMP"

  if ssh-keygen -lf "$TMP" >/dev/null 2>/dev/null
  then
    SSH_KEY_FILE="$TMP"
  else
    die "INVALID $PASS_KEY_DATA in $TMP"
  fi

  [[ "$?" -ne 0      ]] && die "NOT FOUND $PASS_KEY_DATA"
  [[ -z "$3"         ]] && SSH_KEY_UNLOCK="$(pass "$PASS_KEY_UNLOCK")"
  [[ "$?" -ne 0      ]] && die "NOT FOUND $PASS_KEY_UNLOCK"

  if [[ -z "$CRED_USER" ]]
  then
    CRED_USER="$(pass "$PASS_KEY_USER")"
    [[ "$?" -ne 0    ]] && die "NOT FOUND $PASS_KEY_USER"
  fi

else

  SSH_KEY_FILE="$2"
  [[ -e "$SSH_KEY_FILE" ]] || die "NOT FOUND FILE: $SSH_KEY_FILE"

  if ! ssh-keygen -lf "$SSH_KEY_FILE" >/dev/null 2>/dev/null
  then
    die "INVALID $SSH_KEY_FILE"
  fi

  [[ -z "$3" ]] || SSH_KEY_UNLOCK="$3"

fi

# https://liquidat.wordpress.com/2019/05/05/howto-adding-ssh-keys-to-ansible-tower-via-tower-cli/
SSH_KEY_DATA="$(sed -E ':a;N;$!ba;s/\r{0,1}\n/\\n/g' "$SSH_KEY_FILE")"

[[ -z "$SSH_KEY_DATA" ]] && die "NOT FOUND SSH_KEY_DATA"

if [[ -z "$SSH_KEY_UNLOCK" ]]
then

CREDENTIAL_INPUT="$(cat << EOF
{
  "username": "$CRED_USER",
  "ssh_key_data": "$SSH_KEY_DATA"
}
EOF
)"

else

CREDENTIAL_INPUT="$(cat << EOF
{
  "username": "$CRED_USER",
  "ssh_key_data": "$SSH_KEY_DATA",
  "ssh_key_unlock": "$SSH_KEY_UNLOCK"
}
EOF
)"

fi

awx-cli credential modify              \
  --credential-type "$CREDENTIAL_TYPE" \
  --name "$CREDENTIAL"                 \
  --organization "$ORGANIZATION"       \
  --inputs "$CREDENTIAL_INPUT"     "$ID"

rm -f "$TMP"