name: VPN 연결 (F5 BIG-IP)
description: F5 BIG-IP VPN 클라이언트를 설치하고 웹 로그인/OTP를 자동화해 VPN에 연결

inputs:
  deb-path:
    required: false
    default: ""
    description: F5 VPN 클라이언트 .deb 경로. 비어있으면 deb-url에서 다운로드
  deb-url:
    required: false
    default: "https://gitea.pitap.at/public/commonDeploy/releases/download/setup01/linux_f5vpn.x86_64.deb"
    description: F5 VPN 클라이언트 .deb 다운로드 URL

  vpn-host:
    required: true
    description: F5 VPN 호스트 (예 https://vpn.example.com)
  vpn-user:
    required: true
    description: VPN 사용자 ID
  vpn-password:
    required: true
    description: VPN 정적 비밀번호
  otp-seed:
    required: true
    description: TOTP 시드 키 (이 값으로 매 실행 OTP 코드를 로컬 생성)
  otp-seed-format:
    required: false
    default: "base64"
    description: >
      OTP 시드 포맷. base32=구글OTP류 문자열(대문자/공백 자동 정규화),
      hex=16진수 문자열, base64=base64로 인코딩된 키.
  otp-mode:
    required: false
    default: "form"
    description: >
      호환성용 입력. 현재 웹 로그인 방식은 password 단계 후 OTP를 ga_code_attempt 폼에 별도 제출합니다.
  debug-otp:
    required: false
    default: "false"
    description: "true면 seed 검증용으로 생성된 OTP를 로그에 출력합니다. 확인 후 즉시 false로 되돌리세요."

  resource-name:
    required: false
    default: "/Common/dw_default_na"
    description: F5 Network Access 리소스 이름
  timeout:
    required: false
    default: "90"
    description: 연결 완료 대기 최대 시간(초)

runs:
  using: composite
  steps:
    - name: 의존성/F5 VPN 클라이언트 설치
      shell: bash
      env:
        DEB_PATH: ${{ inputs.deb-path }}
        DEB_URL: ${{ inputs.deb-url }}
      run: |
        set -eu

        SUDO=""
        [ "$(id -u)" -ne 0 ] && SUDO="sudo"

        if ! command -v apt-get >/dev/null 2>&1; then
          echo "apt 기반 Linux 러너가 필요합니다."
          exit 1
        fi

        $SUDO apt-get update
        $SUDO apt-get install -y --no-install-recommends \
          ca-certificates curl python3 coreutils dbus-x11 xvfb xdotool x11-utils procps iproute2 \
          libxslt1.1 libsqlite3-0 libgl1 libglib2.0-0 libx11-xcb1 libxcb1 \
          libxcb-render0 libxcb-shape0 libxcb-xfixes0 libxcb-shm0 libxrender1 \
          libxi6 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 \
          libxrandr2 libxtst6 libfontconfig1 libfreetype6

        DEB=""
        if [ -n "$DEB_PATH" ]; then
          DEB="$DEB_PATH"
        elif [ -n "$DEB_URL" ]; then
          DEB="/tmp/f5-vpn-client.deb"
          curl -fsSL -o "$DEB" "$DEB_URL"
        fi

        if [ -z "$DEB" ] || [ ! -f "$DEB" ]; then
          echo ".deb를 찾을 수 없습니다 (deb-path/deb-url 확인)"
          exit 1
        fi

        echo "F5 VPN 클라이언트 설치: $DEB"
        $SUDO dpkg -i "$DEB" || $SUDO apt-get install -f -y

        if [ ! -x /opt/f5/vpn/f5vpn ]; then
          echo "/opt/f5/vpn/f5vpn 이 설치되지 않았습니다."
          exit 1
        fi

    - name: TUN 디바이스 확인
      shell: bash
      run: |
        set -eu
        if [ ! -c /dev/net/tun ]; then
          echo "/dev/net/tun 이 없습니다. 러너에 --device /dev/net/tun --cap-add=NET_ADMIN 필요"
          exit 1
        fi

    - name: VPN 연결
      shell: bash
      env:
        VPN_HOST: ${{ inputs.vpn-host }}
        VPN_USER: ${{ inputs.vpn-user }}
        VPN_PASS: ${{ inputs.vpn-password }}
        OTP_SEED: ${{ inputs.otp-seed }}
        OTP_SEED_FORMAT: ${{ inputs.otp-seed-format }}
        DEBUG_OTP: ${{ inputs.debug-otp }}
        RESOURCE_NAME: ${{ inputs.resource-name }}
        TIMEOUT: ${{ inputs.timeout }}
      run: |
        set -eu

        WORKDIR="${RUNNER_TEMP:-/tmp}/f5-vpn-action"
        COOKIE_JAR="$WORKDIR/cookies.txt"
        LAUNCH_URL_FILE="$WORKDIR/f5-vpn-launch-url.txt"
        UA="Mozilla/5.0 (X11; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0"
        mkdir -p "$WORKDIR"
        rm -f "$COOKIE_JAR" "$LAUNCH_URL_FILE"

        CONNECTED=0
        cleanup() {
          if [ "$CONNECTED" = "1" ]; then
            return
          fi
          if [ -n "${F5VPN_PID:-}" ] && kill -0 "$F5VPN_PID" 2>/dev/null; then
            kill "$F5VPN_PID" 2>/dev/null || true
          fi
          if [ -n "${XVFB_PID:-}" ] && kill -0 "$XVFB_PID" 2>/dev/null; then
            kill "$XVFB_PID" 2>/dev/null || true
          fi
        }
        trap cleanup EXIT

        totp() {
          python3 - "$OTP_SEED" "$OTP_SEED_FORMAT" "${1:-0}" <<'PY'
        import base64
        import hashlib
        import hmac
        import struct
        import sys
        import time

        seed, fmt, offset_windows = sys.argv[1], sys.argv[2], int(sys.argv[3])
        seed = "".join(seed.split())

        def decode_base32(value):
            normalized = value.replace(" ", "").upper().rstrip("=")
            normalized += "=" * ((8 - len(normalized) % 8) % 8)
            return base64.b32decode(normalized)

        if fmt == "base64":
            decoded = base64.b64decode(seed)
            try:
                maybe_base32 = decoded.decode("ascii").replace(" ", "").upper()
                if maybe_base32 and all(ch in "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=" for ch in maybe_base32):
                    raw = decode_base32(maybe_base32)
                else:
                    raw = decoded
            except UnicodeDecodeError:
                raw = decoded
        elif fmt == "base32":
            raw = decode_base32(seed)
        elif fmt == "hex":
            raw = bytes.fromhex(seed)
        else:
            raise SystemExit(f"잘못된 otp-seed-format: {fmt}")

        counter = int(time.time() // 30) + offset_windows
        digest = hmac.new(raw, struct.pack(">Q", counter), hashlib.sha1).digest()
        offset = digest[-1] & 0x0f
        code = (struct.unpack(">I", digest[offset:offset + 4])[0] & 0x7fffffff) % 1000000
        print(f"{code:06d}")
        PY
        }

        curl_common() {
          curl -k -sS --http1.1 -A "$UA" "$@"
        }

        summarize_html() {
          page="$1"
          if [ ! -f "$page" ]; then
            return
          fi
          title="$(sed -n 's/.*<title>\(.*\)<\/title>.*/\1/ip' "$page" | head -1 | tr -d '\r' || true)"
          if [ -n "$title" ]; then
            echo "응답 title: $title"
          fi
          if grep -q "ga_code_attempt" "$page"; then
            echo "응답 상태: OTP 입력 폼이 다시 표시됨"
          fi
          sed 's/<[^>]*>/\n/g' "$page" |
            sed 's/&nbsp;/ /g; s/&amp;/\&/g; s/^[[:space:]]*//; s/[[:space:]]*$//' |
            grep -Eai 'incorrect|invalid|denied|failed|failure|error|otp|password|인증|실패|오류|잘못|거부' |
            grep -Ev '^$' |
            head -10 || true
        }

        echo "F5 웹 로그인 시작: ${VPN_HOST} (user=${VPN_USER})"
        curl_common -L -c "$COOKIE_JAR" "$VPN_HOST/" -o "$WORKDIR/01-login.html"

        curl_common -L -b "$COOKIE_JAR" -c "$COOKIE_JAR" \
          -X POST "$VPN_HOST/my.policy" \
          --data-urlencode "username=$VPN_USER" \
          --data-urlencode "password=$VPN_PASS" \
          --data-urlencode "vhost=standard" \
          -o "$WORKDIR/02-otp.html"

        if ! grep -q "ga_code_attempt" "$WORKDIR/02-otp.html"; then
          echo "OTP 입력 폼에 도달하지 못했습니다. 사용자명/비밀번호 또는 APM 정책을 확인하세요."
          exit 1
        fi

        host_no_scheme="${VPN_HOST#https://}"
        host_no_scheme="${host_no_scheme#http://}"
        host_no_scheme="${host_no_scheme%%/*}"
        webtop_path="/vdesk/webtop.eui?z=$RESOURCE_NAME&webtop=/Common/dw_webtop&webtop_type=webtop_na_only"

        TOKEN_HEADERS="$WORKDIR/04-token.headers"
        otc=""
        while [ $(( $(date +%s) % 30 )) -gt 22 ]; do
          sleep 1
        done

        for otp_offset in 0 -1 1; do
          echo "OTP 제출 시도 (time-window offset=${otp_offset})"
          OTP_CODE="$(totp "$otp_offset")"
          if [ "$DEBUG_OTP" = "true" ]; then
            echo "DEBUG generated OTP offset=${otp_offset}: ${OTP_CODE} (unix-time=$(date +%s))"
          fi
          rm -f "$TOKEN_HEADERS" "$WORKDIR/04-token.body"

          curl_common -L -b "$COOKIE_JAR" -c "$COOKIE_JAR" \
            -X POST "$VPN_HOST/my.policy" \
            --data-urlencode "ga_code_attempt=$OTP_CODE" \
            --data-urlencode "vhost=standard" \
            -o "$WORKDIR/03-webtop-${otp_offset}.html"

          curl_common -b "$COOKIE_JAR" -c "$COOKIE_JAR" \
            -D "$TOKEN_HEADERS" \
            -H "X-Requested-With: XMLHttpRequest" \
            -H "Accept: */*" \
            -e "$VPN_HOST$webtop_path" \
            "$VPN_HOST/vdesk/get_token_for_sessid.php3" \
            -o "$WORKDIR/04-token.body"

          otc="$(
            awk 'BEGIN{IGNORECASE=1} /^X-ACCESS-Session-Token:/ { sub(/\r$/, ""); print substr($0, index($0, ":") + 2) }' "$TOKEN_HEADERS" |
            tail -n 1
          )"
          if [ -n "$otc" ]; then
            break
          fi

          if ! grep -q "ga_code_attempt" "$WORKDIR/03-webtop-${otp_offset}.html"; then
            break
          fi
        done

        if [ -z "$otc" ]; then
          echo "F5 session token 획득 실패"
          for page in "$WORKDIR"/03-webtop-*.html; do
            summarize_html "$page"
          done
          summarize_html "$WORKDIR/04-token.body"
          exit 1
        fi

        base_url="f5-vpn://$host_no_scheme?server=$host_no_scheme&resourcename=$RESOURCE_NAME&resourcetype=network_access&cmd=launch&protocol=https&port=443&sid=nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn"
        token="$(printf '%s' "$base_url" | md5sum | awk '{print $1}')"
        printf '%s\n' "$base_url&token=$token&otc=$otc" > "$LAUNCH_URL_FILE"

        # F5 번들 Qt 5.5는 Xvfb RandR refresh rate에서 SIGFPE가 나므로 RandR 확장을 끈다.
        Xvfb :99 -screen 0 1280x800x24 -extension RANDR >"$WORKDIR/xvfb.log" 2>&1 &
        XVFB_PID=$!
        sleep 1

        export DISPLAY=:99
        export HOME="$WORKDIR/home"
        mkdir -p "$HOME"

        echo "F5 VPN 클라이언트 실행"
        /opt/f5/vpn/f5vpn "$(cat "$LAUNCH_URL_FILE")" >"$WORKDIR/f5vpn.out" 2>"$WORKDIR/f5vpn.err" &
        F5VPN_PID=$!

        for _ in $(seq 1 20); do
          if xwininfo -root -tree 2>/dev/null | grep -q "F5 VPN - Security Warning"; then
            xdotool mousemove 650 398 click 1
            break
          fi
          sleep 1
        done

        echo "연결 완료 대기 중 (최대 ${TIMEOUT}초)..."
        for _ in $(seq 1 "$TIMEOUT"); do
          if ip link show tun0 >/dev/null 2>&1; then
            CONNECTED=1
            echo "VPN 연결 완료"
            ip -br addr show tun0
            exit 0
          fi
          if ! kill -0 "$F5VPN_PID" 2>/dev/null; then
            echo "f5vpn이 tun0 생성 전에 종료되었습니다."
            sed -n '1,120p' "$WORKDIR/f5vpn.err" || true
            tail -120 "$HOME/.F5Networks/vpn.log" 2>/dev/null || true
            exit 1
          fi
          sleep 1
        done

        echo "VPN 연결 실패 (${TIMEOUT}초 초과)."
        sed -n '1,120p' "$WORKDIR/f5vpn.err" || true
        tail -120 "$HOME/.F5Networks/vpn.log" 2>/dev/null || true
        exit 1