#!/bin/bash
# Reads /etc/vexor/license.lic (JWT), decodes payload, returns:
#   OK     if valid_until > 30 days away
#   WARN   if 7-30 days
#   CRIT   if <7 days, expired, or missing/corrupt
LIC=/etc/vexor/license.lic
if [ ! -r "$LIC" ]; then
  echo "CRITICAL: license file $LIC missing or unreadable"
  exit 2
fi
TOKEN=$(tr -d ' \n\r\t' < "$LIC")
PAYLOAD_B64=$(echo "$TOKEN" | cut -d. -f2)
[ -z "$PAYLOAD_B64" ] && { echo "CRITICAL: license file is not a JWT"; exit 2; }
# base64url -> base64
P=$(echo "$PAYLOAD_B64" | tr '_-' '/+')
# pad to multiple of 4
case $(( ${#P} % 4 )) in 2) P="${P}==";; 3) P="${P}=";; esac
PAYLOAD=$(echo "$P" | base64 -d 2>/dev/null) || { echo "CRITICAL: cannot base64-decode JWT payload"; exit 2; }
EXP=$(echo "$PAYLOAD" | grep -oE '"valid_until":"[^"]+"' | head -1 | cut -d'"' -f4)
LID=$(echo "$PAYLOAD" | grep -oE '"license_id":"[^"]+"' | head -1 | cut -d'"' -f4)
if [ -z "$EXP" ]; then
  echo "CRITICAL: cannot parse valid_until from license payload"
  exit 2
fi
EXP_TS=$(date -d "$EXP" +%s 2>/dev/null || echo 0)
NOW_TS=$(date +%s)
if [ "$EXP_TS" -eq 0 ]; then
  echo "CRITICAL: cannot parse valid_until='$EXP' as date"
  exit 2
fi
DAYS=$(( (EXP_TS - NOW_TS) / 86400 ))
PERF="| days_left=$DAYS;30;7;0;"
if [ "$DAYS" -lt 0 ]; then
  echo "CRITICAL: license $LID expired $((-DAYS)) days ago ($EXP) $PERF"; exit 2
elif [ "$DAYS" -lt 7 ]; then
  echo "CRITICAL: license $LID expires in $DAYS days ($EXP) $PERF"; exit 2
elif [ "$DAYS" -lt 30 ]; then
  echo "WARNING: license $LID expires in $DAYS days ($EXP) $PERF"; exit 1
else
  echo "OK: license $LID valid for $DAYS more days ($EXP) $PERF"; exit 0
fi
