#!/bin/bash

# pre-install:
# aws-cli, jq
#
# Usage
# share-pca.sh "pca" pcaArn mAccountProfile dAccountProfile
#

caName=$1
pcaArn=$2
mAccountProfile=$3
dAccountProfile=$4

permissions=$(cat <<EOF
{
    "default": "AWSRAMDefaultPermissionCertificateAuthority",
    "signClient": "AWSRAMEndEntityClientAuthCertificateIssuanceCertificateAuthority",
    "signServer": "AWSRAMEndEntityServerAuthCertificateIssuanceCertificateAuthority",
    "signBlank": "AWSRAMBlankEndEntityCertificateAPICSRPassthroughIssuanceCertificateAuthority",
    "revoke": "AWSRAMRevokeCertificateCertificateAuthority"
}
EOF
)

# get pca arn region
region=$(echo $pcaArn | cut -d":" -f4)
echo "region=$region"

# validte arn
aws acm-pca describe-certificate-authority --certificate-authority-arn=$pcaArn \
  --profile=$mAccountProfile --region=$region --no-cli-pager > /dev/null
if test $? -ne 0; then
    echo "Invalid pca arn"
    exit 1
fi

# get target account id
dAccountId=$(aws sts get-caller-identity --query="Account" --profile=$dAccountProfile --output=text --no-cli-pager)
if test $? -ne 0; then
  echo "Failed to get target account id"
  exit 1
fi

sharedArns=$(aws ram list-resources --resource-owner=SELF \
  --resource-arns="$pcaArn" --principal="$dAccountId"  \
  --query="resources[].resourceShareArn" \
  --profile=$mAccountProfile --region=$region --output=text --no-cli-pager)
if test $? -ne 0; then
  echo "Failed to shared resources list"
  exit 1
fi

name=$(echo "$permissions" | jq -r 'keys[]')
for name in $name; do
  permission=$(echo "$permissions" | jq -r ".$name")
  permissionArn="arn:aws:ram::aws:permission/$permission"
  shareName="$caName-$name-$dAccountId"

  # check if shared
  shared="false"
  for shareArn in $sharedArns; do
    sharedPermissionArn=$(aws ram list-resource-share-permissions --resource-share-arn=$shareArn \
      --query="permissions[0].arn" \
      --profile=$mAccountProfile --region=$region --no-cli-pager --output=text)
    if test $? -ne 0; then
      echo "Failed to get shared permission for $shareArn"
      exit 1
    fi
    if [[ $sharedPermissionArn == $permissionArn ]]; then
      shared="true"
      echo "has already shared with $dAccountId for permission $permission"
    fi
  done
  if [[ $shared == "true" ]]; then
    continue
  fi

  shareArn=$(aws ram create-resource-share --name="$shareName" \
    --resource-arn=$pcaArn --query="resourceShare.resourceShareArn" \
    --permission-arns=$permissionArn --principals=$dAccountId \
    --profile=$mAccountProfile --region=$region --output=text  --no-cli-pager )
  if test $? -ne 0; then
      echo "Failed to create invitation $shareName for permission $permission"
      exit 1
  fi
  echo "shareArn=$shareArn"
  invitationArn=$(aws ram get-resource-share-invitations --resource-share-arns=$shareArn \
      --query "resourceShareInvitations[0].resourceShareInvitationArn" \
      --profile=$dAccountProfile --region=$region --output=text --no-cli-pager )
  if test $? -ne 0; then
      echo "Failed to get share invitation $shareArn for permission $permission"
      exit 1
  fi
  echo "invitationArn=$invitationArn"
  status=$(aws ram accept-resource-share-invitation --resource-share-invitation-arn=$invitationArn \
    --query "resourceShareInvitation.status" \
    --profile=$dAccountProfile --region=$region --no-cli-pager)
  if test $? -ne 0; then
      echo "Failed to accept invitation $shareName for permission $permission"
      exit 1
  fi
  echo "Shared $caName with $dAccountId as $shareName for permission $permission"
done