From ddf0733353ed9bd58a7764e817b919a6dc92d44e Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Fri, 14 Nov 2025 22:02:10 +0000
Subject: [PATCH] Fix update_allowed_nodes to remove comment headers

The awk logic was removing allowed_nodes sections but leaving their
comment headers behind. When multiple sections existed, comments would
accumulate.

New approach:
- Buffer all comment lines encountered outside sections
- When a non-comment line is found, flush buffered comments
- When allowed_nodes is found, discard buffered comments (they belonged
  to the section we're removing)
- This cleanly removes section headers like:
  '# Cluster nodes (auto-discovered during installation)'
  '# These nodes are allowed to request...'

Tested with config containing duplicate allowed_nodes sections - now
correctly produces clean output with all duplicates and headers removed.
---
 scripts/install-sensor-proxy.sh | 47 ++++++++++++++++++++++++++++-----
 1 file changed, 40 insertions(+), 7 deletions(-)

diff --git a/scripts/install-sensor-proxy.sh b/scripts/install-sensor-proxy.sh
index 636c2c7..9065eb0 100755
--- a/scripts/install-sensor-proxy.sh
+++ b/scripts/install-sensor-proxy.sh
@@ -73,15 +73,48 @@ update_allowed_nodes() {
     tmp_config=$(mktemp)
 
     # Remove any existing allowed_nodes section (including the YAML key and all list items)
-    # This handles multi-line allowed_nodes blocks by removing from "allowed_nodes:" through the next non-indented line
+    # This handles multi-line allowed_nodes blocks and associated comment headers
     if [[ -f "$config_file" ]]; then
         awk '
-            /^allowed_nodes:/ { in_section=1; next }
-            in_section && /^[^ \t#]/ { in_section=0 }
-            in_section && /^[ \t]*#/ { next }
-            in_section && /^[ \t]*-/ { next }
-            in_section && /^[ \t]*$/ { next }
-            !in_section { print }
+            # When we hit allowed_nodes, mark section start and clear pending comments
+            /^allowed_nodes:/ {
+                in_section=1
+                delete pending_lines
+                pending_count=0
+                next
+            }
+
+            # Inside section: skip all content until we hit a non-indented, non-comment line
+            in_section && /^[^ \t#]/ {
+                in_section=0
+                # Fall through to print this line
+            }
+            in_section {
+                next
+            }
+
+            # Outside section: buffer comment lines (they might belong to allowed_nodes)
+            !in_section && /^[ \t]*#/ {
+                pending_lines[pending_count++] = $0
+                next
+            }
+
+            # Outside section: non-comment line - flush pending comments and print
+            !in_section {
+                for (i = 0; i < pending_count; i++) {
+                    print pending_lines[i]
+                }
+                delete pending_lines
+                pending_count = 0
+                print
+            }
+
+            # At end of file, flush any remaining pending comments
+            END {
+                for (i = 0; i < pending_count; i++) {
+                    print pending_lines[i]
+                }
+            }
         ' "$config_file" > "$tmp_config"
 
         # Preserve file permissions