241664
      ˆl–Ü4ý()¨‰P@Šë�¿p)‹FÿÇ0ÅÄ  9   ˆl–Ü4ý()¨‰P@Š7åÀº¦-ÿÈƒh¹a–Ü4ý()¨‰P@ŠåÁ	LZ7ÿÆ      256
     ˆÃÉƒ}·Å¾Æ %x    #!/usr/local/cpanel/3rdparty/bin/perl

# cpanel - scripts/notify_expiring_certificates    Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

package scripts::notify_expiring_certificates;

use strict;
use warnings;

=encoding utf-8

=head1 USAGE

    notify_expiring_certificates [ --help ]

=head1 DESCRIPTION

This script checks for expiring SSL certificates and sends notifications
to user and admin for certificates that are about to expire or have already
expired.

This script does nothing if C<notify_expiring_certificates> is disabled
in Tweak Settings.

=cut

use parent qw( Cpanel::HelpfulScript );

use Cpanel::Time::ISO                       ();
use Cpanel::Update::Recent                  ();
use Cpanel::Apache::TLS::Index              ();
use Cpanel::Apache::TLS                     ();
use Cpanel::SSL::Objects::Certificate::File ();
use Cpanel::SSL::Auto::Config::Read         ();
use Cpanel::SSL::Notify                     ();
use Cpanel::Transaction::File::JSON         ();
use Cpanel::Config::LoadCpConf              ();
use Cpanel::AcctUtils::DomainOwner::Tiny    ();
use Cpanel::AcctUtils::Suspended            ();
use Cpanel::Features::Check                 ();
use Cpanel::Domain::Owner                   ();
use Cpanel::LinkedNode::AccountCache        ();
use Cpanel::PromiseUtils                    ();

use Try::Tiny;

our $LAST_NOTIFY_RUN_FILE = '/var/cpanel/ssl/notify_expiring_certificates.json';

use constant DAY_IN_SECONDS => 86400;

use constant _OPTIONS => ();

run(@ARGV) if !caller;

sub run {
    my (@args) = @_;

    return 1 if $ENV{'CPANEL_BASE_INSTALL'};

    #Instantiate this to process --help and other args.
    my $self = __PACKAGE__->new(@args);

    return 0 unless Cpanel::Config::LoadCpConf::loadcpconf_not_copy()->{'notify_expiring_certificates'};

    return $self->script();
}

sub _time { return time(); }    # for tests

sub script {
    my ($self) = @_;

    # This is a no-op if there are no certificates installed.
    return if !@{ [ Cpanel::Apache::TLS->get_tls_vhosts() ] };

    Cpanel::AcctUtils::DomainOwner::Tiny::build_domain_cache() if !$Cpanel::AcctUtils::DomainOwner::Tiny::CACHE_IS_SET;

    my $atls_idx       = Cpanel::Apache::TLS::Index->new();
    my $all_records_ar = $atls_idx->get_all_ar();
    my $now            = _time();                             # make sure all the notification checks are for the same time

    my $trans         = Cpanel::Transaction::File::JSON->new( path => $LAST_NOTIFY_RUN_FILE );
    my $last_run_data = $trans->get_data();
    if ( ref $last_run_data ne 'HASH' ) {
        $trans->set_data( {} );
        $last_run_data = $trans->get_data();
    }

    $last_run_data->{'notify_history_by_uniq_key'} ||= {};
    $last_run_data->{'last_notified_time'} = $now;

    my $notify_history_by_uniq_id_hr = $last_run_data->{'notify_history_by_uniq_key'};

    _delete_notify_history_for_uniq_keys_that_no_longer_exist( $notify_history_by_uniq_id_hr, $all_records_ar );

    _notify_and_remember_for_each_vhost_if_needed( $now, $notify_history_by_uniq_id_hr, $all_records_ar );

    $trans->save_and_close_or_die();

    return 1;
}

# We need a uniq key for each entry to track if
# we have sent a notification for each interval
# that we can delete when the cert or vhost
# is changed/removed.
sub _get_uniq_key_for_atls_entry {
    my ($entry) = @_;

    return join( '|', $entry->{'vhost_name'}, $entry->{'certificate_id'} );
}

sub _delete_notify_history_for_uniq_keys_that_no_longer_exist {
    my ( $notify_history_by_uniq_id_hr, $all_records_ar ) = @_;

    my %current_uniq_keys = map { _get_uniq_key_for_atls_entry($_) => 1 } @$all_records_ar;

    my @uniq_keys_that_no_longer_exist = grep { !$current_u