#!/usr/bin/env bash
# Create the custom integration and its decoders through the Wazuh indexer
# Content Manager API, then normalise a sample event with Log test.
#
# Endpoints, envelopes and field names come from the Wazuh 5.0-beta indexer API
# specification:
#   https://documentation.wazuh.com/5.0-beta/user-manual/indexer-api/reference.html
#   https://documentation.wazuh.com/5.0-beta/_static/indexer-api-spec/content_manager_api.yml
#
# Everything created here lands in the draft space. Promote draft -> test ->
# custom from Security Analytics > Overview > Actions > Promote, or with
# POST /_plugins/_content_manager/promote.
set -euo pipefail

INDEXER="${INDEXER:-https://localhost:9200}"
# AUTH must be set to user:password for an account that holds the
# content_manager permissions. The script refuses to run with a default.
if [ -z "${AUTH:-}" ]; then
  echo "Set AUTH=user:password (an indexer account with content_manager permissions) before running." >&2
  exit 2
fi

# One helper per body type: the indexer rejects a request that carries two
# Content-Type headers, so JSON and YAML calls must not share one.
curl_cm() {
  curl -sk -u "${AUTH}" -H 'Content-Type: application/json' "$@"
}
curl_cm_yaml() {
  curl -sk -u "${AUTH}" -H 'Content-Type: application/yaml' "$@"
}

echo "1. Create the integration in the draft space"
# Required resource fields on create: author, category, title.
# 'id' and 'mode' must NOT be sent; the indexer sets them.
INTEGRATION_ID=$(curl_cm -X POST "${INDEXER}/_plugins/_content_manager/integrations" -d '{
  "resource": {
    "metadata": {
      "title": "portal-audit",
      "author": "Security engineering",
      "description": "Audit log of the internal portal application.",
      "references": ["https://documentation.wazuh.com/5.0-beta/user-manual/data-analysis/integration.html"]
    },
    "category": "access-management",
    "enabled": true
  }
}' | python3 -c 'import json,sys; print(json.load(sys.stdin)["message"])')
echo "   integration id: ${INTEGRATION_ID}"

echo "2. Create the root decoder"
curl_cm_yaml -X POST "${INDEXER}/_plugins/_content_manager/decoders" \
  --data-binary "$(printf 'integration: %s\nresource:\n' "${INTEGRATION_ID}"; sed -e '/^---$/d' -e '/^#/d' -e 's/^/  /' decoder-core-wazuh-message.yml)"
echo

echo "3. Create the JSON child decoder"
curl_cm_yaml -X POST "${INDEXER}/_plugins/_content_manager/decoders" \
  --data-binary "$(printf 'integration: %s\nresource:\n' "${INTEGRATION_ID}"; sed -e '/^---$/d' -e '/^#/d' -e 's/^/  /' decoder-portal-audit-json.yml)"
echo

echo "4. Create the plain-text child decoder"
curl_cm_yaml -X POST "${INDEXER}/_plugins/_content_manager/decoders" \
  --data-binary "$(printf 'integration: %s\nresource:\n' "${INTEGRATION_ID}"; sed -e '/^---$/d' -e '/^#/d' -e 's/^/  /' decoder-portal-audit-text.yml)"
echo

cat <<'NEXT'

5. Attach decoder/core-wazuh-message/0 as the integration root decoder, in the
   dashboard: Security Analytics > Overview > Actions > Edit.
   This cannot be scripted on beta5: PUT /_plugins/_content_manager/integrations/{id}
   answers "Content of 'decoders' cannot be added or removed via update. Please use
   the specific resource endpoints." and GET on that path is 405.
   Child decoders never run until the integration has a root decoder.

6. Promote draft -> test (the promote body needs a "changes" object; an empty one
   answers "Changes object is required"), then run Log test. Log test only accepts
   the test, custom and standard spaces:
   curl -sk -u "\${AUTH}" -X POST \
     "https://localhost:9200/_plugins/_content_manager/logtest/normalization" \
     -H 'Content-Type: application/json' -d @logtest-normalization.json
NEXT