#!/usr/bin/env bash
set -Eeuo pipefail

LOCAL_TOKEN="/var/lib/shire/marketing-boss/private/social-oauth-tokens.enc.json"

VAULT="/SHiREVault"
RECOVERY_DIR="$VAULT/SHIRE3D/MarketingBoss/recovery"
RECOVERY_TOKEN="$RECOVERY_DIR/social-oauth-tokens.enc.json"
RECOVERY_SHA="$RECOVERY_DIR/social-oauth-tokens.enc.json.sha256"

LOCAL_META_DIR="/var/lib/shire/marketing-boss/recovery"
LOCAL_MANIFEST="$LOCAL_META_DIR/social-oauth-tokens.recovery.sha256"

test -r "$LOCAL_TOKEN" || {
  echo "FAIL: Local encrypted OAuth token is unavailable." >&2
  exit 1
}

REAL_VAULT="$(readlink -f "$VAULT" 2>/dev/null || true)"

test -n "$REAL_VAULT" &&
test -d "$REAL_VAULT" || {
  echo "FAIL: SHiREVault is unavailable." >&2
  exit 1
}

mapfile -t FS_LAYERS < <(
  findmnt -rn -T "$REAL_VAULT" -o FSTYPE 2>/dev/null |
    awk 'NF'
)

NETWORK_FS=""

for FS in "${FS_LAYERS[@]}"; do
  case "$FS" in
    cifs|smb3|nfs|nfs4|fuse.sshfs)
      NETWORK_FS="$FS"
      ;;
  esac
done

test -n "$NETWORK_FS" || {
  echo "FAIL: SHiREVault is not confirmed as network storage." >&2
  exit 1
}

mkdir -p "$RECOVERY_DIR"
install -d -m 0700 -o root -g root "$LOCAL_META_DIR"

TMP="$RECOVERY_DIR/.social-oauth-tokens.enc.json.tmp.$$"

cleanup() {
  rm -f "$TMP"
}

trap cleanup EXIT

cp -- "$LOCAL_TOKEN" "$TMP"

LOCAL_SHA="$(
  sha256sum "$LOCAL_TOKEN" |
    awk '{print $1}'
)"

COPIED_SHA="$(
  sha256sum "$TMP" |
    awk '{print $1}'
)"

test "$LOCAL_SHA" = "$COPIED_SHA" || {
  echo "FAIL: Recovery copy checksum mismatch." >&2
  exit 1
}

mv -f "$TMP" "$RECOVERY_TOKEN"

RECOVERY_READBACK_SHA="$(
  sha256sum "$RECOVERY_TOKEN" |
    awk '{print $1}'
)"

test "$LOCAL_SHA" = "$RECOVERY_READBACK_SHA" || {
  echo "FAIL: SHiREVault recovery read-back mismatch." >&2
  exit 1
}

printf '%s  %s\n' \
  "$LOCAL_SHA" \
  "$RECOVERY_TOKEN" \
  > "$RECOVERY_SHA"

printf '%s  %s\n' \
  "$LOCAL_SHA" \
  "$RECOVERY_TOKEN" \
  > "$LOCAL_MANIFEST"

chmod 0600 "$LOCAL_MANIFEST"
chown root:root "$LOCAL_MANIFEST"

{
  echo "Updated: $(date -u --iso-8601=seconds)"
  echo "Source: $LOCAL_TOKEN"
  echo "Recovery: $RECOVERY_TOKEN"
  echo "SHA-256: $LOCAL_SHA"
  echo "Network filesystem: $NETWORK_FS"
} > "$RECOVERY_DIR/README.txt"

echo "Encrypted OAuth recovery backup: PASS"
echo "SHA-256: $LOCAL_SHA"