#!/bin/bash
# COMPLETE LOG COLLECTION & UPLOAD SCRIPT

device=$(hostname | awk -F'.' '{print $1}')
serial=$(ioreg -c IOPlatformExpertDevice -d 2 | awk -F\" '/IOPlatformSerialNumber/{print $(NF-1)}')
org_id=$(/Library/Addigy/go-agent agent orgid)
title="Complete Logs | "
file_path="/tmp/${title}${org_id} | ${serial}"

# Make temp folder
mkdir "${file_path}"

# Get sysdiagnose
rm -f "${file_path}"/sysdiagnose-${device}.tar.gz
/usr/bin/sysdiagnose -r -f "${file_path}" -A sysdiagnose-${device} -u -b

# Create System Report
system_profiler -xml > "${file_path}"/system_information.spx

# Get Running Processes
ps aux > "${file_path}"/processes.txt

# Get install log
cp /var/log/install.log "${file_path}"/apple-install.log

# Get Addigy logs
rm -Rf "${file_path}"/AddigyLogs
cp -R /Library/Addigy/logs "${file_path}"/AddigyLogs

# Get malwarebytes logs
cp /var/log/com.malwarebytes.EndpointAgent.log "${file_path}"/mwb-ov-logs.log

# Get Splashtop logs
rm -Rf "${file_path}"/SplashtopStreamer
cp -R /Users/Shared/SplashtopStreamer "${file_path}"/SplashtopStreamer

# Get CrashLogs
rm -Rf "${file_path}"/DiagnosticReports
cp -R /Library/Logs/DiagnosticReports "${file_path}"/DiagnosticReports

# Get Addigy Identity Info
rm -Rf "${file_path}"/IdentityLogs
mkdir "${file_path}"/IdentityLogs
if [ $(ls /Library/Security/SecurityAgentPlugins/AddigyIDSync.bundle) ]; then
    echo "Bundle is Installed"
    # Cat the Info plist into a created plist File
    cat /Library/Security/SecurityAgentPlugins/AddigyIDSync.bundle/Contents/Info.plist > "${file_path}"/IdentityLogs/CFBundle.plist
else
    echo "Bundle is Not Installed" > "${file_path}"/IdentityLogs/CFBundle.txt
fi
# Current Auth.db
security authorizationdb read system.login.console > "${file_path}"/IdentityLogs/SecurityAuth.plist
# Addigy Identity Settings (1 = True, 0 = False)"
cat /Library/Addigy/AddigyIDSync/addigyIDSync.plist > "${file_path}"/IdentityLogs/IdentitySettings.plist
# Will grab the records of Users and output into a txt file
dscl localhost -readall /Local/Default/Users RecordName | grep @ > "${file_path}"/IdentityLogs/UsersIdentity.txt
# Will transfer the Identity logs into a created log file
log show --predicate 'subsystem == "com.addigy.Identity"' > "${file_path}"/IdentityLogs/Identity.log

# Get Company Portal / SSO Extension / Entra Broker logs (per-user)
# Replicates Company Portal "Help > Save Diagnostic Data" without user interaction.
rm -Rf "${file_path}"/CompanyPortalLogs
mkdir "${file_path}"/CompanyPortalLogs
for home in /Users/*; do
    user=$(basename "${home}")
    [ "${user}" = "Shared" ] && continue

    # Company Portal app logs
    if [ -d "${home}/Library/Logs/Company Portal" ]; then
        mkdir -p "${file_path}/CompanyPortalLogs/${user}"
        cp -R "${home}/Library/Logs/Company Portal/." "${file_path}/CompanyPortalLogs/${user}/" 2>/dev/null
    fi

    # SSO extension + broker logs
    for d in \
        "${home}/Library/Containers/com.microsoft.CompanyPortalMac.ssoextension/Data/Library/Caches/Logs/Microsoft/SSOExtension" \
        "${home}/Library/Logs/Microsoft"; do
        if [ -d "${d}" ]; then
            mkdir -p "${file_path}/CompanyPortalLogs/${user}"
            cp -R "${d}/." "${file_path}/CompanyPortalLogs/${user}/" 2>/dev/null
        fi
    done
done

# Upload files
body=$(/Library/Addigy/go-utils upload "${file_path}")
curl -d "${body}" -H "Content-Type: application/json" -H "Device-Name: ${title}${device}" -X POST https://log-shipper.addigy.com/api/device-logs

# Delete temp folder
rm -rf "${file_path}"