%global debug_package %{nil}
%global githash 67caf4a3b173ed0b2aa5cde66f6049df754a8f59

Name:           stepca-web
Version:        20260429git67caf4a
Release:        1%{?dist}
Summary:        stepca-web

License:        Unspecified
URL:            https://github.com/damhau/%{name}
Source0:        %{url}/archive/%{githash}.tar.gz
Source1:        %{name}-packages.tar.gz
Source2:        %{name}.service

BuildRequires:  python3 >= 3.8
BuildRequires:  python3-psycopg2 python3-pyOpenSSL python3-jwcrypto python3-flask python3-ldap3 python3-psutil python3-requests python3-protobuf python3-pytz python3-authlib python3-gunicorn python3-jinja2 python3-flask python3-sqlalchemy python3-six python3-jwt
Requires:       python3 python3-psycopg2 python3-pyOpenSSL python3-jwcrypto python3-flask python3-ldap3 python3-psutil python3-requests python3-protobuf python3-pytz python3-authlib python3-gunicorn python3-jinja2 python3-flask python3-sqlalchemy python3-six python3-jwt
BuildRequires:  systemd-rpm-macros
Requires(pre):  shadow-utils

AutoReqProv:    no

%{?systemd_requires}

%description
stepca-web

%prep
%autosetup -n %{name}-%{githash}
tar -zxf %{SOURCE1} -C %{_builddir}/%{name}-%{githash}
sed -i "s|^\( \+ldap_user = \).*|\1'uid=' + username + ',' + self.user_search_base|" %{_builddir}/%{name}-%{githash}/app/libs/auth/ldap_backend.py
sed -i "s|^\( \+attributes=\).*|\1['*', 'memberOf']|" %{_builddir}/%{name}-%{githash}/app/libs/auth/ldap_backend.py
sed -i 's|open("admin.crt"|open(self.cert_file|' %{_builddir}/%{name}-%{githash}/app/libs/stepapi.py
sed -i 's|open("admin.key"|open(self.key_file|' %{_builddir}/%{name}-%{githash}/app/libs/stepapi.py
sed -i 's|"admin.crt"|"/var/run/stepca-web/admin.crt"|' %{_builddir}/%{name}-%{githash}/app/libs/stepapi.py
sed -i 's|"admin.key"|"/var/run/stepca-web/admin.key"|' %{_builddir}/%{name}-%{githash}/app/libs/stepapi.py
sed -i 's|^\(import json\)$|from flask import session\nimport re\n\1|' %{_builddir}/%{name}-%{githash}/app/libs/db_x509.py
sed -i 's/^\( \+\)\(certs.append(.* parsed,.*\)/\1gcert = get_generated_cert_by_serial(parsed["serial"])\n\1if not gcert:\n\1        gcert = { "created_at" : "", "signed_by" : "" }\n\1if not re.fullmatch(r"^CN=step($|,.*)$", parsed["subject"], re.IGNORECASE):\n    \1\2/' %{_builddir}/%{name}-%{githash}/app/libs/db_x509.py
sed -i 's/^\( \+certs.append(.* parsed,.*\)})/\1, "created_at" : gcert["created_at"], "signed_by": gcert["signed_by"]})/' %{_builddir}/%{name}-%{githash}/app/libs/db_x509.py
sed -i 's|^\( \+\)\("certificate": row.certificate,\)$|\1\2\n\1"signed_by": row.signed_by,|' %{_builddir}/%{name}-%{githash}/app/libs/db_x509.py
sed -i "s|^\( \+\)\(new_cert =.*\))|\1\2, signed_by=session['user_id'])|" %{_builddir}/%{name}-%{githash}/app/libs/db_x509.py
sed -i 's|^\( \+\)\(created_at =.*\)|\1\2\n\1signed_by = db.Column(db.String, nullable=False)|' %{_builddir}/%{name}-%{githash}/app/models/x509.py
sed -i 's|^\( \+\)\(.*{cert.data.subject}.*\)|\1<p><strong>Signed By:</strong> ${cert.signed_by}</p>\n\1<p><strong>Created At:</strong> ${cert.created_at}</p>\n\1\2|' %{_builddir}/%{name}-%{githash}/app/templates/x509/active_certs.html

%build

%install
%{__mkdir_p} %{buildroot}/opt/%{name}
%{__mkdir_p} %{buildroot}/etc/%{name}
cp -r %{_builddir}/%{name}-%{githash}/* %{buildroot}/opt/%{name}/
python3 -m venv --system-site-packages %{buildroot}/opt/%{name}/venv
%{buildroot}/opt/%{name}/venv/bin/pip install --no-index --find-links=%{_builddir}/%{name}-%{githash}/packages_dir python-jose flask-login flask_sqlalchemy flask_wtf
rm -fr %{buildroot}/opt/%{name}/packages_dir
for f in ../pyvenv.cfg activate activate.csh activate.fish pip pip3 pip3.12 pyrsa-decrypt pyrsa-encrypt pyrsa-keygen pyrsa-priv2pub pyrsa-sign pyrsa-verify; do sed -i "s|%{buildroot}||g" %{buildroot}/opt/%{name}/venv/bin/$f; done
rm -f %{buildroot}/opt/%{name}/{Dockerfile,requirements.txt}
install -D -p -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/%{name}.service

%pre
getent group caweb >/dev/null || groupadd -r caweb
getent passwd caweb >/dev/null || useradd -r -g caweb -d /etc/stepca-web -s /sbin/nologin -c "caweb" caweb
exit 0

%post
%systemd_post %{name}.service

%preun
%systemd_preun %{name}.service

%postun
%systemd_postun_with_restart %{name}.service

%files
%defattr(-,root,root,-)
/opt/%{name}
%dir %attr(0700, caweb, caweb) /etc/%{name}
%{_unitdir}/%{name}.service

%changelog
* Sat Sep 05 2026 Release 1
- Initial package release