Code Update

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023-2024 Warén Group
+Copyright (c) 2023-2025 Warén Group
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

maintainer.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [ ! "$BASH_VERSION" ] ; then
+    bash $0 $1 $2 $3 $4 $5 $6 $7 $8 $9
+    exit 1
+fi
+
+if [[ -f "./wx" ]] && [[ -d "./src" ]]
+then
+    podman run -it --rm -v "$PWD":/usr/src/myapp -w /usr/src/myapp docker.io/library/php:8-cli php generator.php &> /dev/null
+    mv wx.tmp wx &> /dev/null
+    chmod +x wx &> /dev/null
+fi

src/base.sh

@@ -22,7 +22,6 @@ declare -Ax config
 {{ FUNCTIONS }}
 {{ COMMANDS }}
 
-wx-start
 if [[ ! -z $1 ]] && [[ $(type -t wx-$1) == function ]]
 then
     wx-$1 $2 $3 $4 $5 $6 $7 $8 $9

src/commands/auth/login.sh

@@ -1,18 +1,9 @@
 wx-login(){
-    ORG=$1
-
-    if [[ -z "$HOSTNAME" || ${#HOSTNAME} -lt 5 ]]
-    then
-        echo "          >> Login <<         "
-        echo "------------------------------"
-
-        echo "Status: Hostname Required"
-        wx-stop
-    fi
-
     if [[ ! -z $1 ]]
     then
         ORG=$1
+        jq '.org = "'$ORG'"' $HOME/.warengroup/config.json 1> $HOME/.warengroup/config.json.tmp
+        mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
     elif [[ $(hostname -d) = *"devices.waren.io" ]]
     then
         ORG=warengroup
@@ -22,10 +13,11 @@ wx-login(){
     elif [[ $(hostname -d) = *"devices.christerwaren.fi" ]]
     then
         ORG=cwchristerw
+    elif [[ $USER != "root" && $USER != "local" && -f "$HOME/.warengroup/config.json" && $(cat $HOME/.warengroup/config.json | jq -r .org) != "null" ]]
+    then
+        ORG=$(cat $HOME/.warengroup/config.json | jq -r .org)
     else
-        echo "          >> Login <<         "
+        wx-header "Login"
-        echo "------------------------------"
-
         echo "Status: Organization Required"
         wx-stop
     fi
@@ -40,41 +32,23 @@ wx-login(){
     then
         DOMAIN=christerwaren.fi
     else
-        echo "          >> Login <<         "
+        wx-header "Login"
-        echo "------------------------------"
-
         echo "Status: Organization Unsupported"
         wx-stop
     fi
 
     FOLDER=$ORG
     DEVICE_DOMAIN="devices.$DOMAIN"
-    IDM_DOMAIN="idm.cwinfo.net"
+    IDM_DOMAIN="idm.waren.io"
     VAULT_DOMAIN="vault.cwinfo.net"
 
-    if [[ ! -z $2 ]]
-    then
-        HOSTNAME="$2.$DEVICE_DOMAIN"
-    elif [[ $(hostname -d) ]]
-    then
-        HOSTNAME=$(hostname --fqdn)
-    else
-        echo "          >> Login <<         "
-        echo "------------------------------"
-
-        echo "Status: Hostname Required"
-        wx-stop
-    fi
-
     if [[ -z $USER || $USER == "root" || $USER == "local" ]]
     then
         if [[ -z $SUDO_USER ]]
         then
             if [[ -z LOGNAME ]]
             then
-                echo "          >> Login <<         "
+                wx-header "Login"
-                echo "------------------------------"
-
                 echo "Status: Username Required"
                 wx-stop
             else
@@ -83,32 +57,40 @@ wx-login(){
         else
             USERNAME=$SUDO_USER
         fi
+    else
+        USERNAME=$USER
     fi
 
     VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/sys/health)
     if [[ $VAULT_STATUS -eq 200 ]]
     then
-        if [[ -f "$HOME/.config/warengroup/config.json" ]]
+
+        if [[ $USER != "root" && $USER != "local" && -f "$HOME/.warengroup/config.json" ]]
         then
-            TOKEN="$(cat $HOME/.config/warengroup/config.json | jq -r .login.$ORG)"
+            if [[ $(cat $HOME/.warengroup/config.json | jq -r .login.$ORG.username) != "null" ]]
+            then
+                USERNAME="$(cat $HOME/.warengroup/config.json | jq -r .login.$ORG.username)"
+            fi
+            TOKEN="$(cat $HOME/.warengroup/config.json | jq -r .login.$ORG.token)"
         fi
 
         VAULT_LOGIN=$(curl https://$VAULT_DOMAIN/v1/auth/token/renew -X POST --header "X-Vault-Token: $TOKEN" -d '{ "token": "'$TOKEN'" }' -s | jq -r '.auth.client_token')
         if [[ ! -z $VAULT_LOGIN && ${#VAULT_LOGIN} == 95 ]]
         then
             config["login",${ORG}]=$VAULT_LOGIN
-            jq '.login.'$ORG' = "'$VAULT_LOGIN'"' $HOME/.config/warengroup/config.json &> $HOME/.config/warengroup/config.json.tmp
+            if [[ $USER != "root" && $USER != "local" ]]
-            mv $HOME/.config/warengroup/config.json.tmp $HOME/.config/warengroup/config.json &> /dev/null
+            then
+                jq '.login.'$ORG'.token = "'$VAULT_LOGIN'"' $HOME/.warengroup/config.json 1> $HOME/.warengroup/config.json.tmp
+                mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+            fi
         else
             IDM_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$IDM_DOMAIN)
             if [[ $IDM_STATUS -eq 301 ]]
             then
-                echo "          >> Login <<         "
+                wx-header "Login"
-                echo "------------------------------"
-
                 echo $wxBold$ORG$wxNormal
 
-                if [[ -z $USERNAME || $USERNAME == "root" || $USERNAME == "local" ]]
+                if [[ -z $USERNAME || $USERNAME == "root" || $USERNAME == "local" || $USERNAME == "nobody" ]]
                 then
                     echo -n "Username: "
                     read USERNAME
@@ -116,6 +98,9 @@ wx-login(){
                     echo "Username: $USERNAME"
                 fi
 
+                jq '.login.'$ORG'.username = "'$USERNAME'"' $HOME/.warengroup/config.json 1> $HOME/.warengroup/config.json.tmp
+                mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+
                 echo -n "Password: "
                 read -s PASSWORD
                 echo "****************"
@@ -133,15 +118,15 @@ wx-login(){
                     fi
 
                     config["login",${ORG}]=$VAULT_LOGIN
-                    jq '.login.'$ORG' = "'$VAULT_LOGIN'"' $HOME/.config/warengroup/config.json &> $HOME/.config/warengroup/config.json.tmp
-                    mv $HOME/.config/warengroup/config.json.tmp $HOME/.config/warengroup/config.json &> /dev/null
 
-                    wx-start
+                    if [[ $USER != "root" && $USER != "local" ]]
+                    then
+                        jq '.login.'$ORG'.token = "'$VAULT_LOGIN'"' $HOME/.warengroup/config.json &> $HOME/.warengroup/config.json.tmp
+                        mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+                    fi
                 fi
             else
-                echo "          >> Login <<         "
+                wx-header "Login"
-                echo "------------------------------"
-
                 echo $wxBold$ORG$wxNormal
 
                 echo -n "Token: "
@@ -162,18 +147,17 @@ wx-login(){
                 fi
 
                 config["login",${ORG}]=$VAULT_LOGIN
-                jq '.login.'$ORG' = "'$VAULT_LOGIN'"' $HOME/.config/warengroup/config.json &> $HOME/.config/warengroup/config.json.tmp
-                mv $HOME/.config/warengroup/config.json.tmp $HOME/.config/warengroup/config.json &> /dev/null
 
-                wx-start
+                if [[ $USER != "root" && $USER != "local" ]]
+                then
+                    jq '.login.'$ORG'.token = "'$VAULT_LOGIN'"' $HOME/.warengroup/config.json &> $HOME/.warengroup/config.json.tmp
+                    mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+                fi
             fi
         fi
     else
-        echo "          >> Login <<         "
+        wx-header "Login"
-        echo "------------------------------"
-
         echo $wxBold$ORG$wxNormal
-
         echo "Status: Vault Offline"
         wx-stop
     fi

src/commands/auth/logout.sh

@@ -0,0 +1,13 @@
+wx-logout(){
+    wx-header "Logout"
+    if [[ $USER != "root" && $USER != "local" && -f "$HOME/.warengroup/config.json" ]]
+    then
+        VAULT_LOGIN=$(cat $HOME/.warengroup/config.json | jq -r .login)
+        if [[ $VAULT_LOGIN != null && $VAULT_LOGIN != "{}" ]]
+        then
+            wx-clean &> /dev/null
+            jq '.login = {}' $HOME/.warengroup/config.json &> $HOME/.warengroup/config.json.tmp
+            mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+        fi
+    fi
+}

src/commands/auto.sh

@@ -1,10 +0,0 @@
-wx-auto(){
-    wx-login
-
-    echo "          >> Auto <<          "
-    echo "------------------------------"
-
-    wx-ssh-config-sync
-    wx-ssh-keys-sync
-    wx-ssh-sign
-}

src/commands/help.sh

@@ -1,7 +1,6 @@
 wx-help(){
 
-echo "          >> Help <<          "
+wx-header "Help"
-echo "------------------------------"
 
 echo -n "
 Usage: $0 COMMAND [OPTIONS]
@@ -14,17 +13,28 @@ Common Commands:
       edit        Edit
       save        Save
       sync        Sync
+      clean       Clean
     keys        Keys
       generate    Generate
-      delete      Delete
+      sign        Sign
+      retrieve    Retrieve
       save        Save
       sync        Sync
-    sign        Certificates
+      delete      Delete
+      clean       Clean
+
+Authentication Commands:
+  login      Login
+  logout     Logout
 
 Management Commands:
   auto       Auto
-  login      Login
+  clean      Clean
   settings   Settings
+
+Maintenance Commands:
+  install    Install
+  update     Update
 ";
 
 }

src/commands/infra.sh

@@ -1,14 +1,41 @@
 wx-infra(){
     wx-login
-    wx-ssh-sign &> /dev/null
+    wx-auto &> /dev/null
 
-    echo "          >> Infra <<         "
+    wx-header "Infra"
-    echo "------------------------------"
+    wx-restricted
-
-    INFRA_PATH="/home/cwchristerw/Desktop/Work in Progress/Programming/warengroup/infra"
 
     case $USERNAME in
         cwchristerw)
+            if [[ -d "$HOME/Desktop/Work in Progress/Programming/warengroup/infra" ]]
+            then
+                INFRA_PATH="$HOME/Desktop/Work in Progress/Programming/warengroup/infra"
+            else
+                if [[ -d "$HOME/.warengroup/infra" ]]
+                then
+                    INFRA_PATH="$HOME/.warengroup/infra"
+                else
+                    INFRA_PATH="$HOME/.warengroup/infra"
+                    mkdir -p "$INFRA_PATH" &> /dev/null
+                    git clone ssh://git@git.waren.io:2222/warengroup-private/infra.git --config core.sshCommand="ssh -i $HOME/.ssh/keys/warengroup-legacy -o ProxyJump=none" "$INFRA_PATH" &> /dev/null
+                fi
+            fi
+
+            if [[ ! -f "$INFRA_PATH/vault/cwchristerw" || ! -f "$INFRA_PATH/vault/warengroup" ]]
+            then
+                mkdir -p "$INFRA_PATH/vault" &> /dev/null
+
+                curl \
+                    -H "X-Vault-Token: ${config["login",$ORG]}" \
+                    -X GET \
+                    https://$VAULT_DOMAIN/v1/cli/data/cwchristerw/settings/infra -s | jq -r '.data.data.cwchristerw' > "$INFRA_PATH/vault/cwchristerw"
+
+                curl \
+                    -H "X-Vault-Token: ${config["login",$ORG]}" \
+                    -X GET \
+                    https://$VAULT_DOMAIN/v1/cli/data/cwchristerw/settings/infra -s | jq -r '.data.data.warengroup' > "$INFRA_PATH/vault/warengroup"
+            fi
+
             if [[ -z $1 ]]
             then
                 echo "Tag Required"
@@ -17,15 +44,26 @@ wx-infra(){
                 then
                     if [[ -z $2 ]]
                     then
-                        echo "Tag Required"
+                        2=init
-                    else
-                        cd "$INFRA_PATH"
-                        ansible-playbook --vault-id warengroup@vault/warengroup playbooks/init.yml -t $2 $3 $4 $5 $6 $7 $8 $9
-                        cd "$OLDPWD"
                     fi
+
+                    cd "$INFRA_PATH"
+                    git pull &> /dev/null
+                    ansible-galaxy collection install -r requirements.yml --upgrade &> /dev/null
+                    ansible-playbook --vault-id warengroup@vault/warengroup --vault-id cwchristerw@vault/cwchristerw playbooks/init.yml -t $2 $3 $4 $5 $6 $7 $8 $9
+                    cd "$OLDPWD"
+                elif [[ $1 == "manager" ]]
+                then
+                    cd "$INFRA_PATH"
+                    git pull &> /dev/null
+                    ansible-galaxy collection install -r requirements.yml --upgrade &> /dev/null
+                    ansible-playbook --vault-id warengroup@vault/warengroup --vault-id cwchristerw@vault/cwchristerw manager.yml $2 $3 $4 $5 $6 $7 $8 $9
+                    cd "$OLDPWD"
                 else
                     cd "$INFRA_PATH"
-                    ansible-playbook --vault-id warengroup@vault/warengroup playbooks.yml -t $1 $2 $3 $4 $5 $6 $7 $8 $9
+                    git pull &> /dev/null
+                    ansible-galaxy collection install -r requirements.yml --upgrade &> /dev/null
+                    ansible-playbook --vault-id warengroup@vault/warengroup --vault-id cwchristerw@vault/cwchristerw playbooks.yml -t $1 $2 $3 $4 $5 $6 $7 $8 $9
                     cd "$OLDPWD"
                 fi
             fi

src/commands/maintenance/install.sh

@@ -0,0 +1,19 @@
+wx-install(){
+    if [[ -z $1 ]]
+    then
+        wx-header "Install"
+    fi
+
+    wx-restricted
+
+    if [[ -f "./wx" ]] && [[ -d "./src" ]]
+    then
+        podman run -it --rm -v "$PWD":/usr/src/myapp -w /usr/src/myapp docker.io/library/php:8-cli php generator.php &> /dev/null
+        mv wx.tmp wx &> /dev/null
+        chmod +x wx &> /dev/null
+    fi
+
+    mkdir $HOME/bin &> /dev/null
+    curl https://git.waren.io/warengroup/wx/raw/branch/master/wx -o $HOME/bin/wx &> /dev/null
+    chmod +x $HOME/bin/wx &> /dev/null
+}

src/commands/maintenance/uninstall.sh

@@ -0,0 +1,8 @@
+wx-uninstall(){
+    wx-header "Uninstall"
+    wx-logout
+    if [[ ! -d "$HOME/.warengroup" ]]
+    then
+        rm "$HOME/.warengroup" -rf
+    fi
+}

src/commands/maintenance/update.sh

@@ -0,0 +1,4 @@
+wx-update(){
+    wx-header "Update"
+    wx-install --update
+}

src/commands/management/auto.sh

@@ -0,0 +1,8 @@
+wx-auto(){
+    wx-login
+    wx-header "Auto"
+
+    wx-ssh-config-sync
+    wx-ssh-keys-sync
+    wx-ssh-keys-sign
+}

src/commands/management/clean.sh

@@ -0,0 +1,6 @@
+wx-clean(){
+    wx-login
+    wx-header "Clean"
+    wx-ssh-config-clean
+    wx-ssh-keys-clean
+}

src/commands/management/settings.sh

@@ -0,0 +1,4 @@
+wx-settings(){
+    wx-login
+    wx-header "Settings"
+}

src/commands/settings.sh

@@ -1,6 +0,0 @@
-wx-settings(){
-    wx-login
-
-    echo "        >> Settings <<        "
-    echo "------------------------------"
-}

src/commands/ssh.sh

@@ -1,13 +1,7 @@
 wx-ssh(){
     wx-login
 
-    mkdir -p $HOME/.ssh/keys
-    chmod 700 -R $HOME/.ssh/keys
-
     case $1 in
-        sign)
-            wx-ssh-sign
-            ;;
         keys)
             wx-ssh-keys $2 $3
             ;;
@@ -15,9 +9,7 @@ wx-ssh(){
             wx-ssh-config $2
             ;;
         *)
-            echo "           >> SSH <<          "
+            wx-header "SSH"
-            echo "------------------------------"
-
             wx-stop
             ;;
     esac

src/commands/ssh/config.sh

@@ -1,6 +1,5 @@
 wx-ssh-config(){
-    echo "      >> SSH / Config <<      "
+    wx-restricted
-    echo "------------------------------"
 
     case $1 in
         edit)
@@ -14,6 +13,9 @@ wx-ssh-config(){
         sync)
             wx-ssh-config-sync
             ;;
+        clean)
+            wx-ssh-config-clean
+            ;;
         *)
             wx-ssh-config-sync
             wx-stop
@@ -22,17 +24,40 @@ wx-ssh-config(){
 }
 
 wx-ssh-config-edit(){
+    wx-header "SSH / Config / Edit"
+    wx-restricted
     nano ~/.ssh/config
 }
 
 wx-ssh-config-save(){
+    wx-header "SSH / Config / Save"
+    wx-restricted
     curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X POST --header "X-Vault-Token: ${config["login",$ORG]}" -d "{ \"data\": { \"data\": \"$(cat ~/.ssh/config | base64 -w 0)\" } }" -s &> /dev/null
 }
 
 wx-ssh-config-sync(){
+    wx-header "SSH / Config / Sync"
+    wx-restricted
     VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}")
     if [[ $VAULT_STATUS -eq 200 ]]
     then
-        echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.data') | base64 -d > ~/.ssh/config 2>&1
+        touch ~/.ssh/config
+        SSH1_CONFIG_MD5=$(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.data' | base64 -d | md5sum | base64)
+        SSH2_CONFIG_MD5=$(cat ~/.ssh/config | md5sum | base64)
+        if [[ $SSH1_CONFIG_MD5 != $SSH2_CONFIG_MD5 ]]
+        then
+            echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.data') | base64 -d > ~/.ssh/config 2>&1
+            chmod 700 ~/.ssh/config
+        fi
+    fi
+}
+
+wx-ssh-config-clean(){
+    wx-header "SSH / Config / Clean"
+    wx-restricted
+    VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}")
+    if [[ -f "$HOME/.ssh/config" && $VAULT_STATUS -eq 200 ]]
+    then
+        rm "$HOME/.ssh/config"
     fi
 }

src/commands/ssh/keys.sh

@@ -1,6 +1,5 @@
 wx-ssh-keys(){
-    echo "       >> SSH / Keys <<       "
+    wx-restricted
-    echo "------------------------------"
 
     case $1 in
         generate)
@@ -8,6 +7,9 @@ wx-ssh-keys(){
             wx-ssh-keys-generate $2
             wx-ssh-keys-save $2
             ;;
+        sign)
+            wx-ssh-keys-sign
+            ;;
         retrieve)
             wx-ssh-keys-retrieve $2
             ;;
@@ -18,16 +20,20 @@ wx-ssh-keys(){
             wx-ssh-keys-sync $2
             ;;
         delete)
-            wx-ssh-keys-remove $2
+            wx-ssh-keys-delete $2
+            ;;
+        clean)
+            wx-ssh-keys-clean $2
             ;;
         *)
-            wx-ssh-keys-sync
             wx-stop
             ;;
     esac
 }
 
 wx-ssh-keys-generate(){
+    wx-header "SSH / Keys / Generate"
+    wx-restricted
     if [[ ! -z $1 ]]
     then
         if [[ ! -f "$HOME/.ssh/keys/$1" ]]
@@ -37,19 +43,67 @@ wx-ssh-keys-generate(){
     fi
 }
 
+wx-ssh-keys-sign(){
+    wx-header "SSH / Keys / Sign"
+    wx-restricted
+
+    if [[ $ORG == "warengroup" && $USERNAME != "cwchristerw" ]]
+    then
+        wx-ssh-keys-sign-create warengroup sysadmin 3600
+    elif [[ $ORG == "cwinfo" && $USERNAME != "cwchristerw" ]]
+    then
+        wx-ssh-keys-sign-create cwinfo sysadmin 3600
+    elif [[ $ORG == "cwchristerw" || $USERNAME == "cwchristerw" ]]
+    then
+        wx-ssh-keys-sign-create warengroup sysadmin 3600
+        wx-ssh-keys-sign-create cwinfo sysadmin 3600
+        wx-ssh-keys-sign-create cwchristerw sysadmin 3600
+    fi
+}
+
+wx-ssh-keys-sign-create(){
+    wx-restricted
+
+    NAME=$1
+    ROLE=$2
+    PRINCIPALS=$2
+    TTL=$3
+
+    if [[ ! -f "$HOME/.ssh/keys/$NAME" ]]
+    then
+        ssh-keygen -t ed25519 -f $HOME/.ssh/keys/$NAME -q -N "" -C "$USERNAME" &> /dev/null
+    fi
+
+    if [[ -f "$HOME/.ssh/keys/$NAME" ]]
+    then
+        echo "$NAME/$ROLE"
+        echo $(curl https://$VAULT_DOMAIN/v1/ssh/sign/$ROLE -X POST --header "X-Vault-Token: ${config["login",$ORG]}" -d "{ \"public_key\": \"$(cat $HOME/.ssh/keys/$NAME.pub)\", \"valid_principals\": \"$PRINCIPALS,$USERNAME\", \"ttl\": \"$TTL\" }" -s | jq -r '.data.signed_key') > ~/.ssh/keys/$NAME.sig 2>&1
+    fi
+}
+
 wx-ssh-keys-retrieve(){
+    if [[ -z $2 ]]
+    then
+        wx-header "SSH / Keys / Retrieve"
+    fi
+
+    wx-restricted
     if [[ ! -z $1 ]]
     then
         VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X GET --header "X-Vault-Token: ${config["login",$ORG]}")
         if [[ $VAULT_STATUS -eq 200 ]]
         then
             echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.private') | base64 -d > ~/.ssh/keys/$1 2>&1
+            chmod 700 ~/.ssh/keys/$1
             echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.public') | base64 -d > ~/.ssh/keys/$1.pub 2>&1
+            chmod 700 ~/.ssh/keys/$1.pub
         fi
     fi
 }
 
 wx-ssh-keys-save(){
+    wx-header "SSH / Keys / Save"
+    wx-restricted
     if [[ ! -z $1 ]]
     then
         if [[ -f "$HOME/.ssh/keys/$1" ]]
@@ -60,5 +114,56 @@ wx-ssh-keys-save(){
 }
 
 wx-ssh-keys-sync(){
-    echo ""
+    wx-header "SSH / Keys / Sync"
+    wx-restricted
+
+    VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/metadata/$USERNAME/settings/ssh/keys -X LIST --header "X-Vault-Token: ${config["login",$ORG]}")
+    if [[ $VAULT_STATUS -eq 200 ]]
+    then
+        for name in $(curl https://$VAULT_DOMAIN/v1/cli/metadata/$USERNAME/settings/ssh/keys -X LIST --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.keys | @sh' | tr -d \')
+        do
+            echo $name
+            wx-ssh-keys-retrieve $name --multiple
+        done
+    fi
+}
+
+wx-ssh-keys-clean(){
+    if [[ -z $1 ]]
+    then
+        wx-header "SSH / Keys / Clean"
+    fi
+    wx-restricted
+
+    if [[ ! -z $1 ]]
+    then
+        if [[ -f "$HOME/.ssh/keys/$1" && $(basename "$HOME/.ssh/keys/$1") != "legacy" ]]
+        then
+            rm "$HOME/.ssh/keys/$1" &> /dev/null
+            rm "$HOME/.ssh/keys/$1.pub" &> /dev/null
+            rm "$HOME/.ssh/keys/$1.sig" &> /dev/null
+        fi
+    else
+        if [[ $ORG == "warengroup" && $USERNAME != "cwchristerw" ]]
+        then
+            wx-ssh-keys-clean warengroup
+        elif [[ $ORG == "cwinfo" && $USERNAME != "cwchristerw" ]]
+        then
+            wx-ssh-keys-clean cwinfo
+        elif [[ $ORG == "cwchristerw" || $USERNAME == "cwchristerw" ]]
+        then
+            wx-ssh-keys-clean warengroup
+            wx-ssh-keys-clean cwinfo
+            wx-ssh-keys-clean cwchristerw
+        fi
+
+        for file in ~/.ssh/keys/*
+        do
+            VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$(basename "$file" .pub) -X GET --header "X-Vault-Token: ${config["login",$ORG]}")
+            if [[ $(basename "$file") != "legacy" && $VAULT_STATUS -eq 200 ]]
+            then
+                rm "$file" &> /dev/null
+            fi
+        done
+    fi
 }

src/commands/ssh/sign.sh

@@ -1,35 +0,0 @@
-wx-ssh-sign(){
-    echo "       >> SSH / Sign <<       "
-    echo "------------------------------"
-
-    if [[ $ORG == "warengroup" ]]
-    then
-        wx-ssh-sign-create warengroup sysadmin 3600
-    elif [[ $ORG == "cwinfo" ]]
-    then
-        wx-ssh-sign-create cwinfo sysadmin 3600
-    elif [[ $ORG == "cwchristerw" ]]
-    then
-        wx-ssh-sign-create warengroup sysadmin 3600
-        wx-ssh-sign-create cwinfo sysadmin 3600
-        wx-ssh-sign-create cwchristerw sysadmin 3600
-    fi
-}
-
-wx-ssh-sign-create(){
-    NAME=$1
-    ROLE=$2
-    PRINCIPALS=$2
-    TTL=$3
-
-    if [[ ! -f "$HOME/.ssh/keys/$NAME" ]]
-    then
-        ssh-keygen -t ed25519 -f $HOME/.ssh/keys/$NAME -q -N "" -C "$USERNAME" &> /dev/null
-    fi
-
-    if [[ -f "$HOME/.ssh/keys/$NAME" ]]
-    then
-        echo "$NAME/$ROLE"
-        echo $(curl https://$VAULT_DOMAIN/v1/ssh/sign/$ROLE -X POST --header "X-Vault-Token: ${config["login",$ORG]}" -d "{ \"public_key\": \"$(cat $HOME/.ssh/keys/$NAME.pub)\", \"valid_principals\": \"$PRINCIPALS,$USERNAME\", \"ttl\": \"$TTL\" }" -s | jq -r '.data.signed_key') > ~/.ssh/keys/$NAME.sig 2>&1
-    fi
-}

src/commands/welcome.sh

@@ -1,4 +1,3 @@
 wx-welcome(){
-    echo "         >> Welcome <<        "
+    wx-header "Welcome"
-    echo "------------------------------"
 }

src/functions/header.sh

@@ -0,0 +1,24 @@
+wx-header(){
+    if [[ $2 == "h1" ]]
+    then
+        echo ""
+        echo ""
+        echo ""
+        echo "=============================="
+        wx-repeat " " $((30/2-${#1}/2))
+        echo -n "$wxBold"
+        echo -n "$1"
+        echo -n "$wxNormal"
+        echo ""
+        echo "=============================="
+    fi
+
+    if [[ $2 == "h2" || -z $2 ]]
+    then
+        wx-start
+        wx-repeat " " $((30/2-6/2-${#1}/2))
+        echo -n ">> $1 <<"
+        echo ""
+        echo "------------------------------"
+    fi
+}

src/functions/repeat.sh

@@ -0,0 +1,5 @@
+wx-repeat() {
+    local str=$1 n=$2 spaces
+    printf -v spaces "%*s" $n " "
+    printf "%s" "${spaces// /$str}"
+}

src/functions/restricted.sh

@@ -0,0 +1,10 @@
+wx-restricted(){
+    if [[ $USER == "root" || $USER == "local" ]]
+    then
+        echo "Status: Command Restricted"
+        echo " "
+        echo " "
+        echo " "
+        exit 1
+    fi
+}

src/functions/start.sh

@@ -1,17 +1,15 @@
 wx-start(){
-    echo ""
+    wx-header "Warén CLI" h1
-    echo ""
-    echo ""
-    echo "=============================="
-    echo -n "$wxBold"
-    echo "           Warén CLI          "
-    echo -n "$wxNormal"
-    echo "=============================="
 
-    mkdir -p $HOME/.config/warengroup &> /dev/null
+    mkdir -p $HOME/.warengroup &> /dev/null
 
-    if [[ ! -f "$HOME/.config/warengroup/config.json" ]]
+    if [[ ! -f "$HOME/.warengroup/config.json" || $(jq -e . < $HOME/.warengroup/config.json &>/dev/null; echo $?) -gt 0 ]]
     then
-        echo '{}' | jq > $HOME/.config/warengroup/config.json
+        echo '{}' | jq > $HOME/.warengroup/config.json
     fi
+
+    mkdir -p $HOME/.ssh/keys
+    chmod 700 -R $HOME/.ssh/keys
+    mkdir -p $HOME/.ssh/multiplex
+    chmod 700 -R $HOME/.ssh/multiplex
 }

src/functions/stop.sh

@@ -2,18 +2,12 @@ wx-stop (){
     echo " "
     echo " "
     echo " "
-    if [[ -f "./wx" ]] && [[ -d "./src" ]]
-    then
-        podman run -it --rm -v "$PWD":/usr/src/myapp -w /usr/src/myapp docker.io/library/php:8-cli php generator.php &> /dev/null
-        mv wx.tmp wx &> /dev/null
-        chmod +x wx &> /dev/null
-    fi
 
-    if [[ $USER != "root" && $USER != "local" ]]
+    wx-install --auto
+
+    if [[ $USERNAME != $USER && $USERNAME != $SUDO_USER && $USERNAME != $LOGNAME ]]
     then
-        mkdir $HOME/bin &> /dev/null
+        wx-logout
-        curl https://git.waren.io/warengroup/wx/raw/branch/master/wx -o $HOME/bin/wx &> /dev/null
-        chmod +x $HOME/bin/wx &> /dev/null
     fi
 
     exit 1

wx

@@ -19,60 +19,82 @@ wxNormal=$(tput sgr0)
 
 declare -Ax config
 
-wx-start(){
+wx-header(){
-    echo ""
+    if [[ $2 == "h1" ]]
-    echo ""
-    echo ""
-    echo "=============================="
-    echo -n "$wxBold"
-    echo "           Warén CLI          "
-    echo -n "$wxNormal"
-    echo "=============================="
-
-    mkdir -p $HOME/.config/warengroup &> /dev/null
-
-    if [[ ! -f "$HOME/.config/warengroup/config.json" ]]
     then
-        echo '{}' | jq > $HOME/.config/warengroup/config.json
+        echo ""
+        echo ""
+        echo ""
+        echo "=============================="
+        wx-repeat " " $((30/2-${#1}/2))
+        echo -n "$wxBold"
+        echo -n "$1"
+        echo -n "$wxNormal"
+        echo ""
+        echo "=============================="
     fi
+
+    if [[ $2 == "h2" || -z $2 ]]
+    then
+        wx-start
+        wx-repeat " " $((30/2-6/2-${#1}/2))
+        echo -n ">> $1 <<"
+        echo ""
+        echo "------------------------------"
+    fi
+}
+
+wx-repeat() {
+    local str=$1 n=$2 spaces
+    printf -v spaces "%*s" $n " "
+    printf "%s" "${spaces// /$str}"
+}
+
+wx-restricted(){
+    if [[ $USER == "root" || $USER == "local" ]]
+    then
+        echo "Status: Command Restricted"
+        echo " "
+        echo " "
+        echo " "
+        exit 1
+    fi
+}
+
+wx-start(){
+    wx-header "Warén CLI" h1
+
+    mkdir -p $HOME/.warengroup &> /dev/null
+
+    if [[ ! -f "$HOME/.warengroup/config.json" || $(jq -e . < $HOME/.warengroup/config.json &>/dev/null; echo $?) -gt 0 ]]
+    then
+        echo '{}' | jq > $HOME/.warengroup/config.json
+    fi
+
+    mkdir -p $HOME/.ssh/keys
+    chmod 700 -R $HOME/.ssh/keys
+    mkdir -p $HOME/.ssh/multiplex
+    chmod 700 -R $HOME/.ssh/multiplex
 }
 
 wx-stop (){
     echo " "
     echo " "
     echo " "
-    if [[ -f "./wx" ]] && [[ -d "./src" ]]
-    then
-        podman run -it --rm -v "$PWD":/usr/src/myapp -w /usr/src/myapp docker.io/library/php:8-cli php generator.php &> /dev/null
-        mv wx.tmp wx &> /dev/null
-        chmod +x wx &> /dev/null
-    fi
 
-    if [[ $USER != "root" && $USER != "local" ]]
+    wx-install --auto
+
+    if [[ $USERNAME != $USER && $USERNAME != $SUDO_USER && $USERNAME != $LOGNAME ]]
     then
-        mkdir $HOME/bin &> /dev/null
+        wx-logout
-        curl https://git.waren.io/warengroup/wx/raw/branch/master/wx -o $HOME/bin/wx &> /dev/null
-        chmod +x $HOME/bin/wx &> /dev/null
     fi
 
     exit 1
 }
 
-wx-auto(){
-    wx-login
-
-    echo "          >> Auto <<          "
-    echo "------------------------------"
-
-    wx-ssh-config-sync
-    wx-ssh-keys-sync
-    wx-ssh-sign
-}
-
 wx-help(){
 
-echo "          >> Help <<          "
+wx-header "Help"
-echo "------------------------------"
 
 echo -n "
 Usage: $0 COMMAND [OPTIONS]
@@ -85,32 +107,70 @@ Common Commands:
       edit        Edit
       save        Save
       sync        Sync
+      clean       Clean
     keys        Keys
       generate    Generate
-      delete      Delete
+      sign        Sign
+      retrieve    Retrieve
       save        Save
       sync        Sync
-    sign        Certificates
+      delete      Delete
+      clean       Clean
+
+Authentication Commands:
+  login      Login
+  logout     Logout
 
 Management Commands:
   auto       Auto
-  login      Login
+  clean      Clean
   settings   Settings
+
+Maintenance Commands:
+  install    Install
+  update     Update
 ";
 
 }
 
 wx-infra(){
     wx-login
-    wx-ssh-sign &> /dev/null
+    wx-auto &> /dev/null
 
-    echo "          >> Infra <<         "
+    wx-header "Infra"
-    echo "------------------------------"
+    wx-restricted
-
-    INFRA_PATH="/home/cwchristerw/Desktop/Work in Progress/Programming/warengroup/infra"
 
     case $USERNAME in
         cwchristerw)
+            if [[ -d "$HOME/Desktop/Work in Progress/Programming/warengroup/infra" ]]
+            then
+                INFRA_PATH="$HOME/Desktop/Work in Progress/Programming/warengroup/infra"
+            else
+                if [[ -d "$HOME/.warengroup/infra" ]]
+                then
+                    INFRA_PATH="$HOME/.warengroup/infra"
+                else
+                    INFRA_PATH="$HOME/.warengroup/infra"
+                    mkdir -p "$INFRA_PATH" &> /dev/null
+                    git clone ssh://git@git.waren.io:2222/warengroup-private/infra.git --config core.sshCommand="ssh -i $HOME/.ssh/keys/warengroup-legacy -o ProxyJump=none" "$INFRA_PATH" &> /dev/null
+                fi
+            fi
+
+            if [[ ! -f "$INFRA_PATH/vault/cwchristerw" || ! -f "$INFRA_PATH/vault/warengroup" ]]
+            then
+                mkdir -p "$INFRA_PATH/vault" &> /dev/null
+
+                curl \
+                    -H "X-Vault-Token: ${config["login",$ORG]}" \
+                    -X GET \
+                    https://$VAULT_DOMAIN/v1/cli/data/cwchristerw/settings/infra -s | jq -r '.data.data.cwchristerw' > "$INFRA_PATH/vault/cwchristerw"
+
+                curl \
+                    -H "X-Vault-Token: ${config["login",$ORG]}" \
+                    -X GET \
+                    https://$VAULT_DOMAIN/v1/cli/data/cwchristerw/settings/infra -s | jq -r '.data.data.warengroup' > "$INFRA_PATH/vault/warengroup"
+            fi
+
             if [[ -z $1 ]]
             then
                 echo "Tag Required"
@@ -119,15 +179,26 @@ wx-infra(){
                 then
                     if [[ -z $2 ]]
                     then
-                        echo "Tag Required"
+                        2=init
-                    else
-                        cd "$INFRA_PATH"
-                        ansible-playbook --vault-id warengroup@vault/warengroup playbooks/init.yml -t $2 $3 $4 $5 $6 $7 $8 $9
-                        cd "$OLDPWD"
                     fi
+
+                    cd "$INFRA_PATH"
+                    git pull &> /dev/null
+                    ansible-galaxy collection install -r requirements.yml --upgrade &> /dev/null
+                    ansible-playbook --vault-id warengroup@vault/warengroup --vault-id cwchristerw@vault/cwchristerw playbooks/init.yml -t $2 $3 $4 $5 $6 $7 $8 $9
+                    cd "$OLDPWD"
+                elif [[ $1 == "manager" ]]
+                then
+                    cd "$INFRA_PATH"
+                    git pull &> /dev/null
+                    ansible-galaxy collection install -r requirements.yml --upgrade &> /dev/null
+                    ansible-playbook --vault-id warengroup@vault/warengroup --vault-id cwchristerw@vault/cwchristerw manager.yml $2 $3 $4 $5 $6 $7 $8 $9
+                    cd "$OLDPWD"
                 else
                     cd "$INFRA_PATH"
-                    ansible-playbook --vault-id warengroup@vault/warengroup playbooks.yml -t $1 $2 $3 $4 $5 $6 $7 $8 $9
+                    git pull &> /dev/null
+                    ansible-galaxy collection install -r requirements.yml --upgrade &> /dev/null
+                    ansible-playbook --vault-id warengroup@vault/warengroup --vault-id cwchristerw@vault/cwchristerw playbooks.yml -t $1 $2 $3 $4 $5 $6 $7 $8 $9
                     cd "$OLDPWD"
                 fi
             fi
@@ -138,21 +209,33 @@ wx-infra(){
     esac
 }
 
+wx-ssh(){
+    wx-login
+
+    case $1 in
+        keys)
+            wx-ssh-keys $2 $3
+            ;;
+        config)
+            wx-ssh-config $2
+            ;;
+        *)
+            wx-header "SSH"
+            wx-stop
+            ;;
+    esac
+}
+
+wx-welcome(){
+    wx-header "Welcome"
+}
+
 wx-login(){
-    ORG=$1
-
-    if [[ -z "$HOSTNAME" || ${#HOSTNAME} -lt 5 ]]
-    then
-        echo "          >> Login <<         "
-        echo "------------------------------"
-
-        echo "Status: Hostname Required"
-        wx-stop
-    fi
-
     if [[ ! -z $1 ]]
     then
         ORG=$1
+        jq '.org = "'$ORG'"' $HOME/.warengroup/config.json 1> $HOME/.warengroup/config.json.tmp
+        mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
     elif [[ $(hostname -d) = *"devices.waren.io" ]]
     then
         ORG=warengroup
@@ -162,10 +245,11 @@ wx-login(){
     elif [[ $(hostname -d) = *"devices.christerwaren.fi" ]]
     then
         ORG=cwchristerw
+    elif [[ $USER != "root" && $USER != "local" && -f "$HOME/.warengroup/config.json" && $(cat $HOME/.warengroup/config.json | jq -r .org) != "null" ]]
+    then
+        ORG=$(cat $HOME/.warengroup/config.json | jq -r .org)
     else
-        echo "          >> Login <<         "
+        wx-header "Login"
-        echo "------------------------------"
-
         echo "Status: Organization Required"
         wx-stop
     fi
@@ -180,41 +264,23 @@ wx-login(){
     then
         DOMAIN=christerwaren.fi
     else
-        echo "          >> Login <<         "
+        wx-header "Login"
-        echo "------------------------------"
-
         echo "Status: Organization Unsupported"
         wx-stop
     fi
 
     FOLDER=$ORG
     DEVICE_DOMAIN="devices.$DOMAIN"
-    IDM_DOMAIN="idm.cwinfo.net"
+    IDM_DOMAIN="idm.waren.io"
     VAULT_DOMAIN="vault.cwinfo.net"
 
-    if [[ ! -z $2 ]]
-    then
-        HOSTNAME="$2.$DEVICE_DOMAIN"
-    elif [[ $(hostname -d) ]]
-    then
-        HOSTNAME=$(hostname --fqdn)
-    else
-        echo "          >> Login <<         "
-        echo "------------------------------"
-
-        echo "Status: Hostname Required"
-        wx-stop
-    fi
-
     if [[ -z $USER || $USER == "root" || $USER == "local" ]]
     then
         if [[ -z $SUDO_USER ]]
         then
             if [[ -z LOGNAME ]]
             then
-                echo "          >> Login <<         "
+                wx-header "Login"
-                echo "------------------------------"
-
                 echo "Status: Username Required"
                 wx-stop
             else
@@ -223,32 +289,40 @@ wx-login(){
         else
             USERNAME=$SUDO_USER
         fi
+    else
+        USERNAME=$USER
     fi
 
     VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/sys/health)
     if [[ $VAULT_STATUS -eq 200 ]]
     then
-        if [[ -f "$HOME/.config/warengroup/config.json" ]]
+
+        if [[ $USER != "root" && $USER != "local" && -f "$HOME/.warengroup/config.json" ]]
         then
-            TOKEN="$(cat $HOME/.config/warengroup/config.json | jq -r .login.$ORG)"
+            if [[ $(cat $HOME/.warengroup/config.json | jq -r .login.$ORG.username) != "null" ]]
+            then
+                USERNAME="$(cat $HOME/.warengroup/config.json | jq -r .login.$ORG.username)"
+            fi
+            TOKEN="$(cat $HOME/.warengroup/config.json | jq -r .login.$ORG.token)"
         fi
 
         VAULT_LOGIN=$(curl https://$VAULT_DOMAIN/v1/auth/token/renew -X POST --header "X-Vault-Token: $TOKEN" -d '{ "token": "'$TOKEN'" }' -s | jq -r '.auth.client_token')
         if [[ ! -z $VAULT_LOGIN && ${#VAULT_LOGIN} == 95 ]]
         then
             config["login",${ORG}]=$VAULT_LOGIN
-            jq '.login.'$ORG' = "'$VAULT_LOGIN'"' $HOME/.config/warengroup/config.json &> $HOME/.config/warengroup/config.json.tmp
+            if [[ $USER != "root" && $USER != "local" ]]
-            mv $HOME/.config/warengroup/config.json.tmp $HOME/.config/warengroup/config.json &> /dev/null
+            then
+                jq '.login.'$ORG'.token = "'$VAULT_LOGIN'"' $HOME/.warengroup/config.json 1> $HOME/.warengroup/config.json.tmp
+                mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+            fi
         else
             IDM_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$IDM_DOMAIN)
             if [[ $IDM_STATUS -eq 301 ]]
             then
-                echo "          >> Login <<         "
+                wx-header "Login"
-                echo "------------------------------"
-
                 echo $wxBold$ORG$wxNormal
 
-                if [[ -z $USERNAME || $USERNAME == "root" || $USERNAME == "local" ]]
+                if [[ -z $USERNAME || $USERNAME == "root" || $USERNAME == "local" || $USERNAME == "nobody" ]]
                 then
                     echo -n "Username: "
                     read USERNAME
@@ -256,6 +330,9 @@ wx-login(){
                     echo "Username: $USERNAME"
                 fi
 
+                jq '.login.'$ORG'.username = "'$USERNAME'"' $HOME/.warengroup/config.json 1> $HOME/.warengroup/config.json.tmp
+                mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+
                 echo -n "Password: "
                 read -s PASSWORD
                 echo "****************"
@@ -273,15 +350,15 @@ wx-login(){
                     fi
 
                     config["login",${ORG}]=$VAULT_LOGIN
-                    jq '.login.'$ORG' = "'$VAULT_LOGIN'"' $HOME/.config/warengroup/config.json &> $HOME/.config/warengroup/config.json.tmp
-                    mv $HOME/.config/warengroup/config.json.tmp $HOME/.config/warengroup/config.json &> /dev/null
 
-                    wx-start
+                    if [[ $USER != "root" && $USER != "local" ]]
+                    then
+                        jq '.login.'$ORG'.token = "'$VAULT_LOGIN'"' $HOME/.warengroup/config.json &> $HOME/.warengroup/config.json.tmp
+                        mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+                    fi
                 fi
             else
-                echo "          >> Login <<         "
+                wx-header "Login"
-                echo "------------------------------"
-
                 echo $wxBold$ORG$wxNormal
 
                 echo -n "Token: "
@@ -302,63 +379,93 @@ wx-login(){
                 fi
 
                 config["login",${ORG}]=$VAULT_LOGIN
-                jq '.login.'$ORG' = "'$VAULT_LOGIN'"' $HOME/.config/warengroup/config.json &> $HOME/.config/warengroup/config.json.tmp
-                mv $HOME/.config/warengroup/config.json.tmp $HOME/.config/warengroup/config.json &> /dev/null
 
-                wx-start
+                if [[ $USER != "root" && $USER != "local" ]]
+                then
+                    jq '.login.'$ORG'.token = "'$VAULT_LOGIN'"' $HOME/.warengroup/config.json &> $HOME/.warengroup/config.json.tmp
+                    mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+                fi
             fi
         fi
     else
-        echo "          >> Login <<         "
+        wx-header "Login"
-        echo "------------------------------"
-
         echo $wxBold$ORG$wxNormal
-
         echo "Status: Vault Offline"
         wx-stop
     fi
 }
 
+wx-logout(){
+    wx-header "Logout"
+    if [[ $USER != "root" && $USER != "local" && -f "$HOME/.warengroup/config.json" ]]
+    then
+        VAULT_LOGIN=$(cat $HOME/.warengroup/config.json | jq -r .login)
+        if [[ $VAULT_LOGIN != null && $VAULT_LOGIN != "{}" ]]
+        then
+            wx-clean &> /dev/null
+            jq '.login = {}' $HOME/.warengroup/config.json &> $HOME/.warengroup/config.json.tmp
+            mv $HOME/.warengroup/config.json.tmp $HOME/.warengroup/config.json &> /dev/null
+        fi
+    fi
+}
+
+wx-install(){
+    if [[ -z $1 ]]
+    then
+        wx-header "Install"
+    fi
+
+    wx-restricted
+
+    if [[ -f "./wx" ]] && [[ -d "./src" ]]
+    then
+        podman run -it --rm -v "$PWD":/usr/src/myapp -w /usr/src/myapp docker.io/library/php:8-cli php generator.php &> /dev/null
+        mv wx.tmp wx &> /dev/null
+        chmod +x wx &> /dev/null
+    fi
+
+    mkdir $HOME/bin &> /dev/null
+    curl https://git.waren.io/warengroup/wx/raw/branch/master/wx -o $HOME/bin/wx &> /dev/null
+    chmod +x $HOME/bin/wx &> /dev/null
+}
+
+wx-uninstall(){
+    wx-header "Uninstall"
+    wx-logout
+    if [[ ! -d "$HOME/.warengroup" ]]
+    then
+        rm "$HOME/.warengroup" -rf
+    fi
+}
+
+wx-update(){
+    wx-header "Update"
+    wx-install --update
+}
+
+wx-auto(){
+    wx-login
+    wx-header "Auto"
+
+    wx-ssh-config-sync
+    wx-ssh-keys-sync
+    wx-ssh-keys-sign
+}
+
+wx-clean(){
+    wx-login
+    wx-header "Clean"
+    wx-ssh-config-clean
+    wx-ssh-keys-clean
+}
+
 wx-settings(){
     wx-login
-
+    wx-header "Settings"
-    echo "        >> Settings <<        "
-    echo "------------------------------"
-}
-
-wx-ssh(){
-    wx-login
-
-    mkdir -p $HOME/.ssh/keys
-    chmod 700 -R $HOME/.ssh/keys
-
-    case $1 in
-        sign)
-            wx-ssh-sign
-            ;;
-        keys)
-            wx-ssh-keys $2 $3
-            ;;
-        config)
-            wx-ssh-config $2
-            ;;
-        *)
-            echo "           >> SSH <<          "
-            echo "------------------------------"
-
-            wx-stop
-            ;;
-    esac
-}
-
-wx-welcome(){
-    echo "         >> Welcome <<        "
-    echo "------------------------------"
 }
 
 wx-ssh-config(){
-    echo "      >> SSH / Config <<      "
+    wx-restricted
-    echo "------------------------------"
 
     case $1 in
         edit)
@@ -372,6 +479,9 @@ wx-ssh-config(){
         sync)
             wx-ssh-config-sync
             ;;
+        clean)
+            wx-ssh-config-clean
+            ;;
         *)
             wx-ssh-config-sync
             wx-stop
@@ -380,24 +490,46 @@ wx-ssh-config(){
 }
 
 wx-ssh-config-edit(){
+    wx-header "SSH / Config / Edit"
+    wx-restricted
     nano ~/.ssh/config
 }
 
 wx-ssh-config-save(){
+    wx-header "SSH / Config / Save"
+    wx-restricted
     curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X POST --header "X-Vault-Token: ${config["login",$ORG]}" -d "{ \"data\": { \"data\": \"$(cat ~/.ssh/config | base64 -w 0)\" } }" -s &> /dev/null
 }
 
 wx-ssh-config-sync(){
+    wx-header "SSH / Config / Sync"
+    wx-restricted
     VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}")
     if [[ $VAULT_STATUS -eq 200 ]]
     then
-        echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.data') | base64 -d > ~/.ssh/config 2>&1
+        touch ~/.ssh/config
+        SSH1_CONFIG_MD5=$(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.data' | base64 -d | md5sum | base64)
+        SSH2_CONFIG_MD5=$(cat ~/.ssh/config | md5sum | base64)
+        if [[ $SSH1_CONFIG_MD5 != $SSH2_CONFIG_MD5 ]]
+        then
+            echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.data') | base64 -d > ~/.ssh/config 2>&1
+            chmod 700 ~/.ssh/config
+        fi
+    fi
+}
+
+wx-ssh-config-clean(){
+    wx-header "SSH / Config / Clean"
+    wx-restricted
+    VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/config -X GET --header "X-Vault-Token: ${config["login",$ORG]}")
+    if [[ -f "$HOME/.ssh/config" && $VAULT_STATUS -eq 200 ]]
+    then
+        rm "$HOME/.ssh/config"
     fi
 }
 
 wx-ssh-keys(){
-    echo "       >> SSH / Keys <<       "
+    wx-restricted
-    echo "------------------------------"
 
     case $1 in
         generate)
@@ -405,6 +537,9 @@ wx-ssh-keys(){
             wx-ssh-keys-generate $2
             wx-ssh-keys-save $2
             ;;
+        sign)
+            wx-ssh-keys-sign
+            ;;
         retrieve)
             wx-ssh-keys-retrieve $2
             ;;
@@ -415,16 +550,20 @@ wx-ssh-keys(){
             wx-ssh-keys-sync $2
             ;;
         delete)
-            wx-ssh-keys-remove $2
+            wx-ssh-keys-delete $2
+            ;;
+        clean)
+            wx-ssh-keys-clean $2
             ;;
         *)
-            wx-ssh-keys-sync
             wx-stop
             ;;
     esac
 }
 
 wx-ssh-keys-generate(){
+    wx-header "SSH / Keys / Generate"
+    wx-restricted
     if [[ ! -z $1 ]]
     then
         if [[ ! -f "$HOME/.ssh/keys/$1" ]]
@@ -434,51 +573,27 @@ wx-ssh-keys-generate(){
     fi
 }
 
-wx-ssh-keys-retrieve(){
+wx-ssh-keys-sign(){
-    if [[ ! -z $1 ]]
+    wx-header "SSH / Keys / Sign"
+    wx-restricted
+
+    if [[ $ORG == "warengroup" && $USERNAME != "cwchristerw" ]]
     then
-        VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X GET --header "X-Vault-Token: ${config["login",$ORG]}")
+        wx-ssh-keys-sign-create warengroup sysadmin 3600
-        if [[ $VAULT_STATUS -eq 200 ]]
+    elif [[ $ORG == "cwinfo" && $USERNAME != "cwchristerw" ]]
-        then
+    then
-            echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.private') | base64 -d > ~/.ssh/keys/$1 2>&1
+        wx-ssh-keys-sign-create cwinfo sysadmin 3600
-            echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.public') | base64 -d > ~/.ssh/keys/$1.pub 2>&1
+    elif [[ $ORG == "cwchristerw" || $USERNAME == "cwchristerw" ]]
-        fi
+    then
+        wx-ssh-keys-sign-create warengroup sysadmin 3600
+        wx-ssh-keys-sign-create cwinfo sysadmin 3600
+        wx-ssh-keys-sign-create cwchristerw sysadmin 3600
     fi
 }
 
-wx-ssh-keys-save(){
+wx-ssh-keys-sign-create(){
-    if [[ ! -z $1 ]]
+    wx-restricted
-    then
-        if [[ -f "$HOME/.ssh/keys/$1" ]]
-        then
-            curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X POST --header "X-Vault-Token: ${config["login",$ORG]}" -d "{ \"data\": { \"private\": \"$(cat ~/.ssh/keys/$1 | base64 -w 0)\", \"public\": \"$(cat ~/.ssh/keys/$1.pub | base64 -w 0)\" } }" -s &> /dev/null
-        fi
-    fi
-}
 
-wx-ssh-keys-sync(){
-    echo ""
-}
-
-wx-ssh-sign(){
-    echo "       >> SSH / Sign <<       "
-    echo "------------------------------"
-
-    if [[ $ORG == "warengroup" ]]
-    then
-        wx-ssh-sign-create warengroup sysadmin 3600
-    elif [[ $ORG == "cwinfo" ]]
-    then
-        wx-ssh-sign-create cwinfo sysadmin 3600
-    elif [[ $ORG == "cwchristerw" ]]
-    then
-        wx-ssh-sign-create warengroup sysadmin 3600
-        wx-ssh-sign-create cwinfo sysadmin 3600
-        wx-ssh-sign-create cwchristerw sysadmin 3600
-    fi
-}
-
-wx-ssh-sign-create(){
     NAME=$1
     ROLE=$2
     PRINCIPALS=$2
@@ -496,8 +611,94 @@ wx-ssh-sign-create(){
     fi
 }
 
+wx-ssh-keys-retrieve(){
+    if [[ -z $2 ]]
+    then
+        wx-header "SSH / Keys / Retrieve"
+    fi
+
+    wx-restricted
+    if [[ ! -z $1 ]]
+    then
+        VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X GET --header "X-Vault-Token: ${config["login",$ORG]}")
+        if [[ $VAULT_STATUS -eq 200 ]]
+        then
+            echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.private') | base64 -d > ~/.ssh/keys/$1 2>&1
+            chmod 700 ~/.ssh/keys/$1
+            echo $(curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X GET --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.data.public') | base64 -d > ~/.ssh/keys/$1.pub 2>&1
+            chmod 700 ~/.ssh/keys/$1.pub
+        fi
+    fi
+}
+
+wx-ssh-keys-save(){
+    wx-header "SSH / Keys / Save"
+    wx-restricted
+    if [[ ! -z $1 ]]
+    then
+        if [[ -f "$HOME/.ssh/keys/$1" ]]
+        then
+            curl https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$1 -X POST --header "X-Vault-Token: ${config["login",$ORG]}" -d "{ \"data\": { \"private\": \"$(cat ~/.ssh/keys/$1 | base64 -w 0)\", \"public\": \"$(cat ~/.ssh/keys/$1.pub | base64 -w 0)\" } }" -s &> /dev/null
+        fi
+    fi
+}
+
+wx-ssh-keys-sync(){
+    wx-header "SSH / Keys / Sync"
+    wx-restricted
+
+    VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/metadata/$USERNAME/settings/ssh/keys -X LIST --header "X-Vault-Token: ${config["login",$ORG]}")
+    if [[ $VAULT_STATUS -eq 200 ]]
+    then
+        for name in $(curl https://$VAULT_DOMAIN/v1/cli/metadata/$USERNAME/settings/ssh/keys -X LIST --header "X-Vault-Token: ${config["login",$ORG]}" -s | jq -r '.data.keys | @sh' | tr -d \')
+        do
+            echo $name
+            wx-ssh-keys-retrieve $name --multiple
+        done
+    fi
+}
+
+wx-ssh-keys-clean(){
+    if [[ -z $1 ]]
+    then
+        wx-header "SSH / Keys / Clean"
+    fi
+    wx-restricted
+
+    if [[ ! -z $1 ]]
+    then
+        if [[ -f "$HOME/.ssh/keys/$1" && $(basename "$HOME/.ssh/keys/$1") != "legacy" ]]
+        then
+            rm "$HOME/.ssh/keys/$1" &> /dev/null
+            rm "$HOME/.ssh/keys/$1.pub" &> /dev/null
+            rm "$HOME/.ssh/keys/$1.sig" &> /dev/null
+        fi
+    else
+        if [[ $ORG == "warengroup" && $USERNAME != "cwchristerw" ]]
+        then
+            wx-ssh-keys-clean warengroup
+        elif [[ $ORG == "cwinfo" && $USERNAME != "cwchristerw" ]]
+        then
+            wx-ssh-keys-clean cwinfo
+        elif [[ $ORG == "cwchristerw" || $USERNAME == "cwchristerw" ]]
+        then
+            wx-ssh-keys-clean warengroup
+            wx-ssh-keys-clean cwinfo
+            wx-ssh-keys-clean cwchristerw
+        fi
+
+        for file in ~/.ssh/keys/*
+        do
+            VAULT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://$VAULT_DOMAIN/v1/cli/data/$USERNAME/settings/ssh/keys/$(basename "$file" .pub) -X GET --header "X-Vault-Token: ${config["login",$ORG]}")
+            if [[ $(basename "$file") != "legacy" && $VAULT_STATUS -eq 200 ]]
+            then
+                rm "$file" &> /dev/null
+            fi
+        done
+    fi
+}
+
 
-wx-start
 if [[ ! -z $1 ]] && [[ $(type -t wx-$1) == function ]]
 then
     wx-$1 $2 $3 $4 $5 $6 $7 $8 $9