#!/usr/bin/env bash

# Fail early and loudly.
set -euo pipefail

sha1 ()
{
    echo -n "$1" | shasum | cut -b1-40
}

user=$1
api_key=$2
fqdn=$3
ip=$4
shift 4

domain=${fqdn#*.}
subdomain=${fqdn%%.*}

ttl=600
now=$(date +%s)
salt=$( (LC_ALL=C tr -c -d A-Za-z0-9 < /dev/urandom || true) | dd bs=1 count=16 2> /dev/null)
base=https://api.nearlyfreespeech.net
request_uri=/dns/$domain/replaceRR
# TODO support IPv6 too.
body="name=$subdomain&type=A&data=$ip&ttl=$ttl"
body_hash=$(sha1 "$body")
hash="$(sha1 "$user;$now;$salt;$api_key;$request_uri;$body_hash")"
auth="$user;$now;$salt;$hash"

echo -n "$body" |
    curl --silent \
        --fail \
        --data @- \
        --header "X-NFSN-Authentication: $auth" \
        $base$request_uri