#!/usr/bin/env sh
set -eu

usage() {
  cat <<USAGE
Uso:
  PFX_PASSWORD='senha' $0 /caminho/certificado.pfx NSU

Variaveis opcionais:
  NFSE_ADN_BASE_URL   Base URL do ADN municipios

Exemplo:
  PFX_PASSWORD='senha' $0 certificados/pinhal.pfx 0
  NFSE_ADN_BASE_URL='https://adn.nfse.gov.br/municipios' PFX_PASSWORD='senha' $0 certificados/pinhal.pfx 0
USAGE
}

if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
  usage
  exit 0
fi

PFX_PATH="${1:-}"
NSU="${2:-}"
BASE_URL="${NFSE_ADN_BASE_URL:-https://adn.producaorestrita.nfse.gov.br/municipios}"

if [ -z "$PFX_PATH" ] || [ -z "$NSU" ]; then
  usage
  exit 2
fi

case "$NSU" in
  *[!0-9]*)
    echo "Erro: NSU deve conter apenas numeros." >&2
    exit 2
    ;;
esac

if [ ! -f "$PFX_PATH" ]; then
  echo "Erro: certificado nao encontrado: $PFX_PATH" >&2
  exit 2
fi

if [ -z "${PFX_PASSWORD:-}" ]; then
  echo "Erro: informe a senha em PFX_PASSWORD." >&2
  exit 2
fi

TMP_DIR=$(mktemp -d)
cleanup() {
  rm -rf "$TMP_DIR"
}
trap cleanup EXIT INT TERM

CERT_PEM="$TMP_DIR/cert.pem"
KEY_PEM="$TMP_DIR/key.pem"

openssl pkcs12 \
  -in "$PFX_PATH" \
  -passin "pass:$PFX_PASSWORD" \
  -nokeys \
  -clcerts \
  -out "$CERT_PEM" >/dev/null

openssl pkcs12 \
  -in "$PFX_PATH" \
  -passin "pass:$PFX_PASSWORD" \
  -nocerts \
  -nodes \
  -out "$KEY_PEM" >/dev/null

curl \
  --silent \
  --show-error \
  --include \
  --cert "$CERT_PEM" \
  --key "$KEY_PEM" \
  -H 'Accept: application/json' \
  "$BASE_URL/DFe/$NSU?lote=true"