#!/bin/sh
set -eu

[ "$(id -u)" = "0" ] || { echo "FAIL must_run_as_root"; exit 1; }
umask 077

rclone_image='rclone/rclone@sha256:623378ad0ff3ebd5cebf77720843c0e02edfe46e2d5b5ac6bed54c6371780dfb'
restic_image='restic/restic@sha256:424a4e1fcc6fe2557b5614239dc71a2c793acb33a83ea217171bd7edc1862dcb'
docker_bin=/usr/local/bin/docker
agent=/usr/local/bin/xtao-secret-agent
base=/volume1/xtao-data/backup-controller
bin="$base/bin"
backup_root=/volume2/xtao-backup/nextcloud
tmp=$(mktemp -d /tmp/xtao-nextcloud-backup.XXXXXX)
trap 'rm -rf "$tmp"' EXIT HUP INT TERM

mkdir -p "$bin" "$backup_root/dumps" "$backup_root/restores" "$backup_root/logs"
chmod 700 "$backup_root" "$backup_root/dumps" "$backup_root/restores" "$backup_root/logs"

"$agent" raw-field --entry external/google-drive/offsite-backup --field rclone_token_json > "$tmp/token.json"
"$agent" raw-field --entry external/google-drive/offsite-backup --field root_folder_id > "$tmp/root_folder_id"
"$agent" raw-field --entry external/google-drive/offsite-backup --field oauth_client_id > "$tmp/oauth_client_id"
"$agent" raw-field --entry external/google-drive/offsite-backup --field oauth_client_secret > "$tmp/oauth_client_secret"
"$agent" raw-field --entry backup/google-drive/restic-repository --field password > "$tmp/restic.pass"
chmod 600 "$tmp/token.json" "$tmp/root_folder_id" "$tmp/oauth_client_id" "$tmp/oauth_client_secret" "$tmp/restic.pass"

python3 - "$tmp/token.json" "$tmp/root_folder_id" "$tmp/oauth_client_id" "$tmp/oauth_client_secret" "$tmp/rclone.conf" <<'PY'
import json, pathlib, sys
token_path, root_path, client_id_path, client_secret_path, config_path = map(pathlib.Path, sys.argv[1:])
token = token_path.read_text(encoding="utf-8").strip()
json.loads(token)
root = root_path.read_text(encoding="utf-8").strip()
if not root or root == "CODEX_GENERATE":
    raise SystemExit("FAIL invalid_root_folder_id")
client_id = client_id_path.read_text(encoding="utf-8").strip()
client_secret = client_secret_path.read_text(encoding="utf-8").strip()
client_lines = ""
if client_id and client_id != "NONE":
    client_lines += f"client_id = {client_id}\n"
if client_secret:
    client_lines += f"client_secret = {client_secret}\n"
config_path.write_text(
    "[xtao-gdrive]\n"
    "type = drive\n"
    "scope = drive.file\n"
    f"{client_lines}"
    f"root_folder_id = {root}\n"
    f"token = {token}\n",
    encoding="utf-8",
)
PY
chmod 600 "$tmp/rclone.conf"

if [ ! -x "$bin/rclone" ]; then
  cid=$("$docker_bin" create --entrypoint /bin/sh "$rclone_image" -c true)
  "$docker_bin" cp "$cid:/usr/local/bin/rclone" "$tmp/rclone"
  "$docker_bin" rm "$cid" >/dev/null
  install -m 700 "$tmp/rclone" "$bin/rclone"
fi

dbuser=$("$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php -r 'include "/var/www/html/config/config.php"; echo $CONFIG["dbuser"];')
dbname=$("$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php -r 'include "/var/www/html/config/config.php"; echo $CONFIG["dbname"];')
case "$dbuser" in *[!A-Za-z0-9_-]*|"") echo "FAIL unexpected_dbuser"; exit 3;; esac
case "$dbname" in *[!A-Za-z0-9_-]*|"") echo "FAIL unexpected_dbname"; exit 3;; esac

ts=$(date -u +%Y%m%dT%H%M%SZ)
dump="$backup_root/dumps/nextcloud-$ts.sql"
"$docker_bin" exec -i nextcloud-nextcloud-db-1 pg_dump -U nextcloud "$dbname" > "$dump"
chmod 600 "$dump"

sample=$(find /volume1/xtao-data/nextcloud/data/xtao-admin/files -maxdepth 1 -type f -name 'phase03-small-*.bin' | sort | tail -n 1)
[ -n "$sample" ] || { echo "FAIL missing_uploaded_canary_file"; exit 3; }
sample_name=$(basename "$sample")
sha256sum "$sample" | awk '{print $1}' > "$tmp/sample.sha256"

restic_env="-e RCLONE_CONFIG=/config/rclone/rclone.conf -e RESTIC_PASSWORD_FILE=/secrets/restic.pass -e RESTIC_REPOSITORY=rclone:xtao-gdrive:restic/nas"
set +e
"$docker_bin" run --rm --network bridge \
  -v "$tmp:/config/rclone" \
  -v "$tmp/restic.pass:/secrets/restic.pass:ro" \
  -v "$bin/rclone:/usr/local/bin/rclone:ro" \
  $restic_env \
  "$restic_image" init >/tmp/xtao-nextcloud-restic-init.out 2>&1
rc=$?
set -e
if [ "$rc" -ne 0 ] && ! grep -Eq 'already initialized|config file already exists' /tmp/xtao-nextcloud-restic-init.out; then
  cat /tmp/xtao-nextcloud-restic-init.out
  echo "FAIL restic_init"
  exit 2
fi

"$docker_bin" run --rm --network bridge \
  -v "$tmp:/config/rclone" \
  -v "$tmp/restic.pass:/secrets/restic.pass:ro" \
  -v "$bin/rclone:/usr/local/bin/rclone:ro" \
  -v "/volume1/xtao-data/nextcloud/data/xtao-admin/files:/backup/files:ro" \
  -v "/volume1/xtao-data/nextcloud/html/config:/backup/config:ro" \
  -v "$backup_root/dumps:/backup/dbdumps:ro" \
  $restic_env \
  "$restic_image" backup --tag phase03-nextcloud-$ts /backup/files /backup/config /backup/dbdumps >/tmp/xtao-nextcloud-restic-backup.out

restore="$backup_root/restores/restore-$ts"
mkdir -p "$restore"
chmod 700 "$restore"
"$docker_bin" run --rm --network bridge \
  -v "$tmp:/config/rclone" \
  -v "$tmp/restic.pass:/secrets/restic.pass:ro" \
  -v "$bin/rclone:/usr/local/bin/rclone:ro" \
  -v "$restore:/restore" \
  $restic_env \
  "$restic_image" restore latest --tag "phase03-nextcloud-$ts" --target /restore >/tmp/xtao-nextcloud-restic-restore.out

restored_sample="$restore/backup/files/$sample_name"
[ -f "$restored_sample" ] || { echo "FAIL restored_sample_missing"; exit 3; }
sha256sum "$restored_sample" | awk '{print $1}' > "$tmp/restored.sha256"
cmp "$tmp/sample.sha256" "$tmp/restored.sha256"
[ -f "$restore/backup/config/config.php" ] || { echo "FAIL restored_config_missing"; exit 3; }
[ -f "$restore/backup/dbdumps/$(basename "$dump")" ] || { echo "FAIL restored_dump_missing"; exit 3; }

restore_db="nc_restore_$(date -u +%H%M%S)"
"$docker_bin" exec -i nextcloud-nextcloud-db-1 createdb -U nextcloud "$restore_db"
set +e
"$docker_bin" exec -i nextcloud-nextcloud-db-1 psql -U nextcloud "$restore_db" < "$restore/backup/dbdumps/$(basename "$dump")" >/tmp/xtao-nextcloud-db-restore.out 2>&1
restore_rc=$?
set -e
if [ "$restore_rc" -ne 0 ]; then
  "$docker_bin" exec -i nextcloud-nextcloud-db-1 dropdb -U nextcloud "$restore_db" || true
  cat /tmp/xtao-nextcloud-db-restore.out
  echo "FAIL isolated_db_restore"
  exit 3
fi
user_count=$("$docker_bin" exec -i nextcloud-nextcloud-db-1 psql -U nextcloud "$restore_db" -Atc "select count(*) from oc_users where uid='xtao-admin';")
file_count=$("$docker_bin" exec -i nextcloud-nextcloud-db-1 psql -U nextcloud "$restore_db" -Atc "select count(*) from oc_filecache where path='files/$sample_name';")
"$docker_bin" exec -i nextcloud-nextcloud-db-1 dropdb -U nextcloud "$restore_db"
[ "$user_count" = "1" ] || { echo "FAIL restored_user_missing"; exit 3; }
[ "$file_count" != "0" ] || { echo "FAIL restored_filecache_missing"; exit 3; }

printf 'PASS nextcloud_backup_restore restic=PASS isolated_db=PASS restored_file=%s values=redacted\n' "$sample_name"