out

#!/bin/bash

set -e

cd "${1}"

exec 3>&1 # make stdout available as fd 3 for the result
exec 1>&2 # redirect all output to stderr for logging
set +x
# for jq
PATH=/usr/local/bin:$PATH

payload=$(cat <&0)

timestamp=$(
    jq --null-input \
        --arg "timestamp" "$(date +%s)" \
        '{ version: { timestamp: $timestamp } }'
)

disable="$(jq --raw-output '.source.disable' <<< "${payload}")"
if [[ ${disable} == "true" ]]; then
    echo "${timestamp}" >&3
    exit 0
fi

webhook_url=$(   jq --raw-output '.source.url'                 <<< "${payload}")
allow_insecure=$(jq --raw-output '.source.insecure // "false"' <<< "${payload}")
raw_ca_certs=$(  jq              '.source.ca_certs // []'      <<< "${payload}")

text_file=$( jq --raw-output '.params.text_file  // ""'                     <<< "${payload}")
text=$(      jq --raw-output '.params.text       // "${TEXT_FILE_CONTENT}"' <<< "${payload}")
username=$(  jq --raw-output '.params.username   // null'                   <<< "${payload}")
icon_url=$(  jq --raw-output '.params.icon_url   // null'                   <<< "${payload}")
icon_emoji=$(jq --raw-output '.params.icon_emoji // null'                   <<< "${payload}")
link_names=$(jq --raw-output '.params.link_names // false'                  <<< "${payload}")

channels=$(        jq --raw-output '.params.channel          // null' <<< "${payload}")
channel_file=$(    jq --raw-output '.params.channel_file     // null' <<< "${payload}")
attachments_file=$(jq --raw-output '.params.attachments_file // ""'   <<< "${payload}")
attachments=$(     jq --raw-output '.params.attachments      // null' <<< "${payload}")

debug=$(        jq --raw-output '.params.debug               // "false"' <<< "${payload}")
show_metadata=$(jq --raw-output '.params.metadata            // "false"' <<< "${payload}")
show_payload=$( jq --raw-output '.params.payload_in_metadata // "false"' <<< "${payload}")
silent=$(       jq --raw-output '.params.silent              // "false"' <<< "${payload}")
always_notify=$(jq --raw-output '.params.always_notify       // "false"' <<< "${payload}")
redact_hook=$(  jq --raw-output '.params.redact_hook_url     // "true"'  <<< "${payload}")

proxy=$(             jq --raw-output '.source.proxy              // "null"'  <<< "${payload}")
proxy_https_tunnel=$(jq --raw-output '.source.proxy_https_tunnel // "false"' <<< "${payload}")

# Read the env_file and export it in the current console
env_file=$(jq --raw-output '.params.env_file // ""' <<< "${payload}")
if [[ -f "${env_file}" ]]; then
    # export key=value, when value as space but no quotes
    search_key_val='(\w+)=([^\n]+)'

    source <(sed -nEe "s/${search_key_val}/export \1=\"\2\"/ p" "${env_file}")
fi

cert_count=$(jq 'length' <<< "${raw_ca_certs}")
if [[ "${cert_count}" -gt 0 ]]; then
    cert_dir="/usr/local/share/ca-certificates/"
    mkdir -p "${cert_dir}"
    for idx in $(seq 0 "$((cert_count - 1))"); do
        domain=$(jq --raw-output ".[$idx].domain" <<< "${raw_ca_certs}")
        jq --raw-output --arg idx "${idx}" ".[$idx].cert" <<< "${raw_ca_certs}" \
            >> "${cert_dir}/ca-cert-${domain}.crt"
  done
  update-ca-certificates
fi

export TEXT_FILE_CONTENT=""
if [[ -n "${text_file}" && ! -f "${text_file}" ]]; then
    text_file=""
fi
if [[ -n "${text_file}" && -f "${text_file}" ]]; then
    TEXT_FILE_CONTENT=$(envsubst < "${text_file}")
fi

ATTACHMENTS_FILE_CONTENT=""
if [[ -n "${attachments_file}" && -f "${attachments_file}" ]]; then
    ATTACHMENTS_FILE_CONTENT=$(< "${attachments_file}")
fi
if [[ "${attachments}" == "null" && -n "${ATTACHMENTS_FILE_CONTENT}" ]]; then
    attachments="${ATTACHMENTS_FILE_CONTENT}"
fi

attachments=$(envsubst <<< "${attachments}")

if [[ -n "${channel_file}" && -f "${channel_file}" ]]; then
    channels="${channels} $(< "${channel_file}")"
fi

curl_errors=0

for channel in ${channels}; do

    debug_info=""
    metadata=""
    body=""

    declare -a CURL_OPTIONS
    if [[ "${allow_insecure}" == "true" ]]; then
        CURL_OPTIONS+=("--insecure")
    fi

    if [[ "${proxy}" != "null" ]]; then
        CURL_OPTIONS+=("--proxy" "${proxy}")
    fi

    if [[ "${proxy_https_tunnel}" == "true" ]]; then
        CURL_OPTIONS+=("--proxytunnel")
    fi

    if [[ "${always_notify}" != "true" && -z "${TEXT_FILE_CONTENT}" && -n "${text_file}" ]]
    then
        text_interplated=$(jq -R -s . <<< "") # produces '"\n"'
    else
        if [[ "${attachments}" == "null" ]]; then
            TEXT_FILE_CONTENT=${TEXT_FILE_CONTENT:-"_(no notification provided)_"}
        fi

        text_interpolated=$(envsubst <<< "${text}")

        if [[ -z "${text_interpolated}" ]]; then
            text_interpolated="_(missing notification text)_"
            if [[ -n "${attachments}" ]]; then
                text_interpolated="null"
            fi
        else
            text_interpolated=$(jq -R -s . <<< "${text_interpolated}")
        fi

        [[ "${username}"   != "null" ]] && username="$(  eval "printf ${username}"    | jq -R -s .)"
        [[ "${icon_url}"   != "null" ]] && icon_url="$(  eval "printf ${icon_url}"    | jq -R -s .)"
        [[ "${icon_emoji}" != "null" ]] && icon_emoji="$(eval "printf ${icon_emoji}"  | jq -R -s .)"
        [[ "${channel}"    != "null" ]] && channel="$(   eval "printf \"${channel}\"" | jq -R -s .)"

        body=$(cat <<EOF
{
  "text": ${text_interpolated},
  "username": ${username},
  "link_names": ${link_names},
  "icon_url": ${icon_url},
  "icon_emoji": ${icon_emoji},
  "channel": ${channel},
  "attachments": ${attachments}
}
EOF
        )

        # needed for mattermost compatibility as they don't accept link_names
        if [[ "${link_names}" == "true" ]]; then
            compact_body=$(jq --compact-output '.' <<< "${body}")
        else
            compact_body=$(
                jq --compact-output \
                    'with_entries(select(.key != "link_names"))' \
                    <<< "${body}"
            )
        fi

        if [[ "${debug}" == "true" ]]; then
            debug_info=$(
                jq --null-input \
                    --arg     "webhook_url" "${webhook_url}" \
                    --argjson "body"        "${body}" \
                    '{
                        webhook_url: $webhook_url,
                        body: $body
                    }'
            )
        elif [[ "${silent}" == "true" ]]; then
            echo "INFO: using silent output"
            curl --silent --fail --show-error --location "${CURL_OPTIONS[@]}" \
                --request "POST" --url "${webhook_url}" \
                --data-raw "${compact_body}"
            curl_errors=$(( ${curl_errors} + $? ))
        elif [[ "${redact_hook}" == "true" ]]; then
            url_path=$(
                sed -Ee 's,https?://[^/]*(/[^?&#]*).*,\1,' <<< "${webhook_url}"
            )
            curl --verbose --silent --fail --show-error --location "${CURL_OPTIONS[@]}" \
                    --request "POST" --url "${webhook_url}" \
                    --data-raw "${compact_body}" 2>&1 \
                | sed -e "s#${url_path}#***WEBHOOK URL REDACTED***#g"
            curl_errors=$(( ${curl_errors} + ${PIPESTATUS[0]} ))
        else
            curl --verbose --silent --fail --show-error --location "${CURL_OPTIONS[@]}" \
                    --request "POST" --url "${webhook_url}" \
                    --data-raw "${compact_body}" \
                | sed -e "s#${url_path}#***WEBHOOK URL REDACTED***#g"
            curl_errors=$(( ${curl_errors} + ${PIPESTATUS[0]} ))
        fi
    fi
done

if [[ "${show_metadata}" == "true" ]]; then
    redacted_webhook_url=$(
        sed -Ee 's|/([^/.]{2})[^/.]{5,}([^/.]{2})|/\1…\2|g' <<< "${webhook_url}"
    )
    if [[ -n "${text_file}" && -f "${text_file}" ]]; then
        text_file_exists="Yes"
    else
        text_file_exists="No"
    fi
    metadata=$(cat <<EOF
{
  "metadata": [
    {"name": "url",               "value": $(jq -R . <<< "${redacted_webhook_url}") },
    {"name": "channel",           "value": "${channels}"                            },
    {"name": "username",          "value": ${username}                              },
    {"name": "text",              "value": ${text_interpolated}                     },
    {"name": "text_file",         "value": $(jq -R .    <<< "${text_file}")         },
    {"name": "text_file_exists",  "value": $(jq -R .    <<< "${text_file_exists}")  },
    {"name": "text_file_content", "value": $(jq -R -s . <<< "${TEXT_FILE_CONTENT}") }
  ]
}
EOF
    )
    if [[ "${show_payload}" == "true" ]]; then
        redacted_payload=$(
            jq --compact-output \
                '.source.url = "***REDACTED***"' <<< "${payload}")
        metadata=$(
            jq --arg "payload" "${redacted_payload}" \
                '.metadata += [ { name: "payload", value: $payload } ]' \
                <<< "${metadata}"
        )
    fi
fi

jq --slurp 'add' \
    <<< "${timestamp} ${metadata} ${debug_info}" \
    >&3

if [[ "${curl_errors}" -ne 0 ]]; then
  echo "ERROR: sending the message to the Slack webhook has failed"
  exit 1
fi