#!/usr/bin/env bash
set -euo pipefail

# rhel-subscription-patch-check.sh
#
# Purpose:
#   Validate common Subscription Manager conditions used in a RHEL patching workflow.
#   This script does not install updates, change subscriptions, or make destructive changes.
#
# What it checks:
#   - subscription-manager is installed
#   - the system identity is available
#   - subscription status can be queried
#   - enabled repositories can be listed
#   - optional package/advisory checks can be performed with yum or dnf
#
# Usage examples:
#   ./rhel-subscription-patch-check.sh
#   ./rhel-subscription-patch-check.sh --package openssl
#   ./rhel-subscription-patch-check.sh --package kernel --show-disabled-repos
#
# Notes:
#   - Run as a user with permission to query system subscription state.
#   - Results are informational and intended to support patch readiness checks.

usage() {
  cat <<'EOF'
Usage: rhel-subscription-patch-check.sh [options]

Options:
  --package NAME           Optional package name to inspect with the system package manager
  --show-disabled-repos    Also display disabled repositories
  --help                  Show this help message

Examples:
  rhel-subscription-patch-check.sh
  rhel-subscription-patch-check.sh --package openssl
  rhel-subscription-patch-check.sh --package kernel --show-disabled-repos
EOF
}

PACKAGE_NAME=""
SHOW_DISABLED_REPOS=false

while [[ $# -gt 0 ]]; do
  case "$1" in
    --package)
      if [[ $# -lt 2 || -z "${2:-}" ]]; then
        echo "Error: --package requires a package name" >&2
        exit 1
      fi
      PACKAGE_NAME="$2"
      shift 2
      ;;
    --show-disabled-repos)
      SHOW_DISABLED_REPOS=true
      shift
      ;;
    --help|-h)
      usage
      exit 0
      ;;
    *)
      echo "Error: unknown option: $1" >&2
      usage >&2
      exit 1
      ;;
  esac
done

command_exists() {
  command -v "$1" >/dev/null 2>&1
}

echo "== Subscription Manager readiness check =="

if ! command_exists subscription-manager; then
  echo "subscription-manager: not installed or not in PATH"
  exit 1
fi

echo "subscription-manager: found"

echo

echo "-- Identity --"
if subscription-manager identity >/dev/null 2>&1; then
  subscription-manager identity
else
  echo "Unable to query system identity. The host may not be registered or access may be restricted."
fi

echo

echo "-- Status --"
if subscription-manager status >/dev/null 2>&1; then
  subscription-manager status
else
  echo "Unable to query subscription status."
fi

echo

echo "-- Enabled repositories --"
if subscription-manager repos --list-enabled >/dev/null 2>&1; then
  subscription-manager repos --list-enabled
else
  echo "Unable to list enabled repositories."
fi

if [[ "$SHOW_DISABLED_REPOS" == true ]]; then
  echo
  echo "-- Disabled repositories --"
  if subscription-manager repos --list-disabled >/dev/null 2>&1; then
    subscription-manager repos --list-disabled
  else
    echo "Unable to list disabled repositories."
  fi
fi

if [[ -n "$PACKAGE_NAME" ]]; then
  echo
  echo "-- Package check: $PACKAGE_NAME --"
  if command_exists dnf; then
    echo "Using dnf to inspect package availability"
    dnf list --available "$PACKAGE_NAME" || echo "Package not visible in currently enabled repositories or dnf query failed."
  elif command_exists yum; then
    echo "Using yum to inspect package availability"
    yum list available "$PACKAGE_NAME" || echo "Package not visible in currently enabled repositories or yum query failed."
  else
    echo "No supported package manager found for package inspection."
  fi
fi

echo

echo "Completed. Review the output above to confirm registration, entitlement, and repository access before remediation."