# bash completion for pkica (КриптоПро УЦ: командная строка управления инфраструктурой УЦ)
#
# Установка:
#   sudo install -m 644 pkica.bash-completion /usr/share/bash-completion/completions/pkica
# или для текущего пользователя:
#   mkdir -p ~/.local/share/bash-completion/completions
#   cp pkica.bash-completion ~/.local/share/bash-completion/completions/pkica
# или разово:
#   source pkica.bash-completion
#
# Дерево команд и опций снято с `pkica ... --help`. Утилита при дополнении
# не вызывается (запуск .NET-приложения слишком медленный).

# Подкоманды узлов дерева. Ключ - путь команды.
declare -gA _pkica_cmds=(
    [pkica]="ca cert-registry ra"
    [pkica ca]="authority cert cert-request crl db import-legacy issue-cert new-cert-req new-root-cert rev-request signing-key template"
    [pkica ca authority]="export-settings import-settings list new remove set-default show"
    [pkica ca cert]="get list"
    [pkica ca cert-request]="get list"
    [pkica ca crl]="get issue schedule"
    [pkica ca crl schedule]="get update"
    [pkica ca db]="info new upgrade"
    [pkica ca rev-request]="get list"
    [pkica ca signing-key]="add change-usage list load replace show unload"
    [pkica ca template]="add encode-extension get list remove update"
    [pkica ca template encode-extension]="certificate-template identification-kind"
    [pkica cert-registry]="db import-legacy"
    [pkica cert-registry db]="info new upgrade"
    [pkica ra]="db folder group import-legacy operator permission settings"
    [pkica ra db]="info new upgrade"
    [pkica ra folder]="add delete get list rename"
    [pkica ra group]="add add-operator get list remove-operator rename"
    [pkica ra operator]="activate add deactivate get list update"
    [pkica ra permission]="get grant revoke"
    [pkica ra settings]="get set"
)

# Опции команд. Синонимы разделены "|", "=" в конце - опция принимает значение.
# Для узлов, отсутствующих в таблице, используется "-h|--help".
declare -gA _pkica_opts=(
    [pkica]="-v|--version -h|--help"
    [pkica ca authority export-settings]="-n|--name= -f|--file= -h|--help --format="
    [pkica ca authority import-settings]="-n|--name= -f|--file= -h|--help --format="
    [pkica ca authority list]="-h|--help --format="
    [pkica ca authority new]="-n|--name= -h|--help"
    [pkica ca authority remove]="-n|--name= -h|--help"
    [pkica ca authority set-default]="-n|--name= --none -h|--help"
    [pkica ca authority show]="-n|--name= -h|--help --format="
    [pkica ca cert get]="-i|--id= -s|--serial-number= -f|--file= --force -h|--help --format="
    [pkica ca cert list]="--from= --to= --take= --oldest-first -h|--help --format="
    [pkica ca cert-request get]="-i|--id= -f|--file= --force -h|--help --format="
    [pkica ca cert-request list]="--from= --to= --take= --oldest-first -h|--help --format="
    [pkica ca crl get]="-n|--name= -v|--valid-at= --all -o|--output-folder= --force -h|--help"
    [pkica ca crl issue]="-n|--name= -d|--delta-only -u|--next-update= --final --key-index= -o|--output-folder= --force -h|--help"
    [pkica ca crl schedule get]="-n|--name= -h|--help"
    [pkica ca crl schedule update]="-n|--name= -b|--base= -d|--delta= -h|--help"
    [pkica ca db info]="-h|--help --format="
    [pkica ca db new]="-s|--storage-type= -c|--connection-string= --command-timeout= -b|--begin-use-empty --force -h|--help"
    [pkica ca db upgrade]="--command-timeout= -h|--help"
    [pkica ca import-legacy]="-c|--connection-string= -t|--timeout= -h|--help"
    [pkica ca issue-cert]="-f|--file= -o|--out-file= -n|--name= -t|--timeout= -h|--help"
    [pkica ca new-cert-req]="-o|--out-file= -t|--template= --template-major-version= --template-minor-version= --is-ca --path-length= -i|--key-index= --subject-sign-tool= --sign-tool-class= --extensions-file= -s|--subject= -c|--container-name= --hash-algorithm= -l|--key-length= --use-existing-key -e|--exportable --prompt-for-media -p|--provider-type= -n|--provider-name= --pin= --no-pin -k|--key-spec= --key-location= --silent -h|--help"
    [pkica ca new-root-cert]="-o|--out-file= -v|--validity= -V|--key-validity= --path-length= -i|--key-index= --extensions-file= --serial-number-algorithm= -s|--subject= -c|--container-name= --hash-algorithm= -l|--key-length= --use-existing-key -e|--exportable --prompt-for-media -p|--provider-type= -n|--provider-name= --pin= --no-pin -k|--key-spec= --key-location= --silent -h|--help"
    [pkica ca rev-request get]="-i|--id= -f|--file= --force -h|--help --format="
    [pkica ca rev-request list]="--from= --to= --take= --oldest-first -h|--help --format="
    [pkica ca signing-key add]="-n|--name= -t|--thumbprint= --store-name= --store-location= -u|--usage= --hash-algorithm= --accept-new-subject --planned-key-change-date= --planned-retirement-date= --pin= --no-pin --skip-container-check -h|--help"
    [pkica ca signing-key change-usage]="-n|--name= -i|--index= -u|--usage= --force -h|--help"
    [pkica ca signing-key list]="-n|--name= -l|--loaded --status --timeout= -h|--help --format="
    [pkica ca signing-key load]="-n|--name= -i|--index= --pin= --no-pin -u|--usage= -h|--help"
    [pkica ca signing-key replace]="-n|--name= -i|--index= -t|--thumbprint= --store-name= --store-location= --hash-algorithm= --accept-new-subject --planned-key-change-date= --planned-retirement-date= --pin= --no-pin --skip-container-check -h|--help"
    [pkica ca signing-key show]="-n|--name= -i|--index= --status --timeout= -h|--help --format="
    [pkica ca signing-key unload]="-n|--name= -i|--index= -h|--help"
    [pkica ca template add]="-f|--file= -d|--default-template= -h|--help"
    [pkica ca template encode-extension certificate-template]="-n|--name= -f|--file= --force -h|--help"
    [pkica ca template encode-extension identification-kind]="-v|--value= -f|--file= --force -h|--help"
    [pkica ca template get]="-n|--name= -f|--file= -h|--help"
    [pkica ca template list]="-f|--file= -d|--detailed -h|--help --format="
    [pkica ca template remove]="-n|--name= -h|--help"
    [pkica ca template update]="-f|--file= -d|--default-template= -h|--help"
    [pkica cert-registry db info]="-h|--help --format="
    [pkica cert-registry db new]="-s|--storage-type= -c|--connection-string= --command-timeout= -b|--begin-use-empty --force -h|--help"
    [pkica cert-registry db upgrade]="--command-timeout= -h|--help"
    [pkica cert-registry import-legacy]="-c|--connection-string= -t|--timeout= -h|--help"
    [pkica ra db info]="-h|--help --format="
    [pkica ra db new]="-s|--storage-type= -c|--connection-string= --command-timeout= -b|--begin-use-empty --force -h|--help"
    [pkica ra db upgrade]="--command-timeout= -h|--help"
    [pkica ra folder add]="-n|--name= -h|--help"
    [pkica ra folder delete]="-n|--name= -h|--help"
    [pkica ra folder get]="-n|--name= -h|--help --format="
    [pkica ra folder list]="-h|--help --format="
    [pkica ra folder rename]="-n|--name= --new-name= -h|--help"
    [pkica ra group add]="-n|--name= -h|--help"
    [pkica ra group add-operator]="-n|--name= -l|--login= -h|--help"
    [pkica ra group get]="-n|--name= -h|--help --format="
    [pkica ra group list]="-h|--help --format="
    [pkica ra group remove-operator]="-n|--name= -l|--login= -h|--help"
    [pkica ra group rename]="-n|--name= --new-name= -h|--help"
    [pkica ra import-legacy]="-c|--connection-string= -l|--login= --folder-id= --include-subfolders --skip-empty-users --skip-revoked-certs --skip-expired-certs -t|--timeout= -h|--help"
    [pkica ra operator activate]="--login= -h|--help"
    [pkica ra operator add]="-l|--last-name= -f|--first-name= -m|--middle-name= --tls-cert-file= --signing-cert-file= -g|--group= --default-folder= --login= -h|--help"
    [pkica ra operator deactivate]="--login= -h|--help"
    [pkica ra operator get]="-l|--login= -h|--help --format="
    [pkica ra operator list]="-g|--group= -l|--last-name= -f|--first-name= -m|--middle-name= -t|--take= -h|--help --format="
    [pkica ra operator update]="--login= --new-login= -l|--last-name= -f|--first-name= -m|--middle-name= --tls-cert-file= --signing-cert-file= --default-folder= --clear-default-folder -h|--help"
    [pkica ra permission get]="--folder= --group= -h|--help --format="
    [pkica ra permission grant]="--folder= --all-folders --group= --all-groups --manage-user --submit-cert-request --resolve-cert-request --submit-rev-request --resolve-rev-request --all -h|--help"
    [pkica ra permission revoke]="--folder= --all-folders --group= --all-groups --manage-user --submit-cert-request --resolve-cert-request --submit-rev-request --resolve-rev-request -h|--help"
    [pkica ra settings get]="-n|--name= -f|--file= -h|--help"
    [pkica ra settings set]="-n|--name= -v|--value= -d|--default -f|--file= -h|--help"
)

# Если $2 - опция команды $1, принимающая значение, печатает ее длинное имя.
_pkica_argopt()
{
    local spec
    for spec in ${_pkica_opts[$1]:--h|--help}; do
        [[ $spec == *= ]] || continue
        spec=${spec%=}
        if [[ "|$spec|" == *"|$2|"* ]]; then
            printf '%s\n' "${spec##*|}"
            return 0
        fi
    done
    return 1
}

# Дополнение значения опции $2 (длинное имя) команды $1.
_pkica_values()
{
    local path=$1 opt=$2 values=

    case $opt in
        --format) values="Json Yaml" ;;
        --storage-type) values="PostgreSql SqlServer" ;;
        --sign-tool-class) values="KC1 KC2 KC3 KB1 KB2 KA1" ;;
        --key-spec) values="Signature KeyExchange" ;;
        --key-location | --store-location) values="CurrentUser LocalMachine" ;;
        --store-name) values="My Root CertificateAuthority AuthRoot AddressBook Disallowed TrustedPeople TrustedPublisher" ;;
        --serial-number-algorithm) values="CryptoPro Msca" ;;
        --provider-type) values="80 81" ;;
        --default-template) values="SubCa User Tls Ocsp Tsp Qual QualOcsp QualTsp" ;;
        --usage)
            if [[ $path == "pkica ca signing-key load" ]]; then
                values="SignCertAndCrl SignCrl"
            else
                values="SignCertAndCrl SignCrl Retired"
            fi
            ;;
        --value)
            [[ $path == *" identification-kind" ]] &&
                values="Personal RemoteCert RemotePassport RemoteSystem"
            ;;
        --name)
            [[ $path == "pkica ra settings "* ]] &&
                values="NamePolicy Templates DefaultAuthority"
            ;;
        --validity | --key-validity)
            COMPREPLY=($(compgen -W "Years: Months: Weeks: Days: Hours: Minutes:" -- "$cur"))
            [[ ${COMPREPLY-} == *: ]] && compopt -o nospace 2>/dev/null
            declare -F __ltrim_colon_completions >/dev/null &&
                __ltrim_colon_completions "$cur"
            return
            ;;
        --file | --out-file | --extensions-file | --tls-cert-file | --signing-cert-file)
            if declare -F _filedir >/dev/null; then
                _filedir
            else
                compopt -o filenames 2>/dev/null
                COMPREPLY=($(compgen -f -- "$cur"))
            fi
            return
            ;;
        --output-folder)
            if declare -F _filedir >/dev/null; then
                _filedir -d
            else
                compopt -o filenames 2>/dev/null
                COMPREPLY=($(compgen -d -- "$cur"))
            fi
            return
            ;;
    esac

    COMPREPLY=($(compgen -W "$values" -- "$cur"))
}

_pkica()
{
    local cur prev words cword split=false
    if declare -F _init_completion >/dev/null; then
        _init_completion -s -n : || return
    else
        words=("${COMP_WORDS[@]}")
        cword=$COMP_CWORD
        cur=${COMP_WORDS[COMP_CWORD]}
        prev=${COMP_WORDS[COMP_CWORD - 1]}
    fi

    # Определяем путь команды, пропуская опции и их значения.
    local path=pkica i w skip=false
    for ((i = 1; i < cword; i++)); do
        w=${words[i]}
        if $skip; then
            skip=false
        elif [[ $w == -* ]]; then
            [[ $w != *=* ]] && _pkica_argopt "$path" "$w" >/dev/null && skip=true
        elif [[ " ${_pkica_cmds[$path]-} " == *" $w "* ]]; then
            path+=" $w"
        fi
    done

    # Значение опции: "--opt value" или "--opt=value".
    local opt
    if $skip || $split; then
        if opt=$(_pkica_argopt "$path" "$prev"); then
            _pkica_values "$path" "$opt"
        fi
        return
    fi

    local subcmds=${_pkica_cmds[$path]-}
    if [[ $cur != -* && -n $subcmds ]]; then
        COMPREPLY=($(compgen -W "$subcmds" -- "$cur"))
        return
    fi

    # Опции, еще не указанные в командной строке. Без "-" в начале
    # предлагаются только длинные имена.
    local spec alias used list=() aliases
    for spec in ${_pkica_opts[$path]:--h|--help}; do
        spec=${spec%=}
        used=false
        IFS='|' read -ra aliases <<<"$spec"
        for ((i = 1; i < cword; i++)); do
            w=${words[i]%%=*}
            for alias in "${aliases[@]}"; do
                [[ $w == "$alias" ]] && used=true && break 2
            done
        done
        $used && continue
        if [[ $cur == -* ]]; then
            list+=("${aliases[@]}")
        else
            list+=("${aliases[${#aliases[@]} - 1]}")
        fi
    done
    COMPREPLY=($(compgen -W "${list[*]}" -- "$cur"))
}

complete -F _pkica pkica