#!/bin/bash
set -euo pipefail

backup_root=/data/early-access-backups
archive_dir=$backup_root/archives
private_key=$backup_root/keys/backup_private.pem
mkdir -p "$archive_dir"
umask 077

read -r action name expected_sha extra <<< "${SSH_ORIGINAL_COMMAND:-}"
if [[ "$action" == "metrics" ]]; then
  if [[ -n "${name:-}" || -n "${expected_sha:-}" || -n "${extra:-}" ]]; then
    echo "Invalid metrics command." >&2
    exit 64
  fi
elif [[ -n "${extra:-}" || ! "$name" =~ ^early-access-[0-9]{8}T[0-9]{6}Z\.tar\.gz$ ]]; then
  echo "Invalid backup command." >&2
  exit 64
fi

case "$action" in
  upload)
    [[ "$expected_sha" =~ ^[a-f0-9]{64}$ ]] || exit 64
    temp=$(mktemp "$archive_dir/.upload.XXXXXX")
    trap 'rm -f "$temp"' EXIT
    cat > "$temp"
    actual_sha=$(sha256sum "$temp" | awk '{print $1}')
    [[ "$actual_sha" == "$expected_sha" ]] || { echo "Archive checksum mismatch." >&2; exit 65; }
    mv "$temp" "$archive_dir/$name"
    chmod 600 "$archive_dir/$name"
    echo "UPLOAD_OK $name"
    ;;
  verify)
    archive=$archive_dir/$name
    [[ -f "$archive" && -r "$private_key" ]] || exit 66
    work_dir=$(mktemp -d)
    trap 'rm -rf "$work_dir"' EXIT
    tar -C "$work_dir" -xzf "$archive"
    openssl pkeyutl -decrypt -inkey "$private_key" \
      -in "$work_dir/passphrase.enc" \
      -out "$work_dir/passphrase" \
      -pkeyopt rsa_padding_mode:oaep \
      -pkeyopt rsa_oaep_md:sha256
    openssl enc -d -aes-256-cbc -pbkdf2 -iter 200000 \
      -in "$work_dir/database.dump.enc" \
      -out "$work_dir/database.dump" \
      -pass file:"$work_dir/passphrase"
    pg_restore --list "$work_dir/database.dump" > /dev/null
    echo "RESTORE_VERIFY_OK $name"
    ;;
  metrics)
    echo "WORKER_1=$(systemctl is-active horus-cyper-worker@1.service || true)"
    echo "WORKER_2=$(systemctl is-active horus-cyper-worker@2.service || true)"
    nvidia-smi --query-gpu=memory.used,memory.free,utilization.gpu,temperature.gpu \
      --format=csv,noheader,nounits | awk -F, '{gsub(/ /,""); print "GPU_USED_MIB="$1"\nGPU_FREE_MIB="$2"\nGPU_UTILIZATION="$3"\nGPU_TEMPERATURE_C="$4}'
    df -P /data | awk 'NR==2 {gsub(/%/,"",$5); print "DATA_DISK_USED_PERCENT="$5}'
    ;;
  *)
    echo "Unsupported backup command." >&2
    exit 64
    ;;
esac

find "$archive_dir" -type f -name 'early-access-*.tar.gz' -mtime +30 -delete
