#!/bin/bash
set -u

DEFAULTS="/etc/default/nivato-logger"
[ -f "$DEFAULTS" ] && . "$DEFAULTS"

PASSWORD_FILE="${NIVATO_PASSWORD_FILE:-/opt/nivato-logger/data/password.bcrypt}"
DATA_DIR="${NIVATO_DATA_DIR:-/opt/nivato-logger/data}"
LOG_DIR="${NIVATO_LOG_DIR:-/opt/nivato-logger/logs}"
DB_FILE="${NIVATO_DB_FILE:-$DATA_DIR/nivato.db}"
HOTSPOT_MARKER="${NIVATO_WIFI_HOTSPOT_DISABLED_MARKER:-$DATA_DIR/hotspot-disabled}"
SECRETS_FILE="$DATA_DIR/mqtt.secrets"
SERVICE_USER="${NIVATO_SERVICE_USER:-ubuntu}"
SERVICE_GROUP="${NIVATO_SERVICE_GROUP:-$SERVICE_USER}"
MQTT_SECRETS_EXAMPLE="/opt/nivato-logger/mqtt.secrets.example"

log() { echo "[nivato-factory-reset] $*"; }
warn() { echo "[nivato-factory-reset] UWAGA: $*" >&2; }

# Bezpieczne czyszczenie zawartości katalogu (zostawia sam folder).
wipe_dir_contents() {
    local dir="$1"
    if [ ! -d "$dir" ]; then
        mkdir -p "$dir" 2>/dev/null || true
        return 0
    fi
    # find + rm — obsługuje ukryte pliki i podkatalogi
    find "$dir" -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null || {
        rm -rf "${dir:?}/"* "${dir}/".[!.]* "${dir}/"..?* 2>/dev/null || true
    }
}

restore_ownership() {
    local path="$1"
    if id "$SERVICE_USER" >/dev/null 2>&1; then
        chown -R "$SERVICE_USER:$SERVICE_GROUP" "$path" 2>/dev/null || true
    fi
    chmod 755 "$path" 2>/dev/null || true
}

schedule_reboot() {
    log "Planowany restart systemu po resecie fabrycznym"
    if command -v systemd-run >/dev/null 2>&1; then
        if systemd-run --unit=nivato-logger-factory-reset-reboot --on-active=10s /sbin/reboot >/dev/null 2>&1; then
            return 0
        fi
    fi
    (sleep 10; /sbin/reboot) >/dev/null 2>&1 &
}

log "=== Reset fabryczny nivato-logger ==="

# 1) Logi aplikacji / instalacji / apt
log "Czyszczę katalog logów: $LOG_DIR"
wipe_dir_contents "$LOG_DIR"
restore_ownership "$LOG_DIR"

# 2) Dane aplikacji (hasło, baza, MQTT, markery, SSL, device-id, …)
log "Czyszczę katalog danych: $DATA_DIR"
# Jawne usunięcie typowych plików zanim wipe (czytelniejsze logi)
rm -f "$PASSWORD_FILE" 2>/dev/null || true
rm -f "$HOTSPOT_MARKER" 2>/dev/null || true
rm -f "$DATA_DIR/update-reboot-at" "$DATA_DIR/update-ready-version" 2>/dev/null || true
rm -f "$SECRETS_FILE" \
    "$DATA_DIR/mqtt-ca.pem" \
    "$DATA_DIR/mqtt-client.pem" \
    "$DATA_DIR/mqtt-client.key" \
    "$DATA_DIR/ssh-hardening.enabled" \
    "$DATA_DIR/device-id" 2>/dev/null || true
rm -f "$DB_FILE" "$DB_FILE-wal" "$DB_FILE-shm" "$DB_FILE-journal" 2>/dev/null || true
rm -rf "$DATA_DIR/ssl" 2>/dev/null || true

wipe_dir_contents "$DATA_DIR"
restore_ownership "$DATA_DIR"

# Szablon sekretów MQTT (jak w postinst) — bez haseł użytkownika
if [ -f "$MQTT_SECRETS_EXAMPLE" ]; then
    cp "$MQTT_SECRETS_EXAMPLE" "$SECRETS_FILE" 2>/dev/null || true
else
    printf '# MQTT secrets (chmod 0600)\nNIVATO_MQTT_USERNAME=\nNIVATO_MQTT_PASSWORD=\n' > "$SECRETS_FILE" 2>/dev/null || true
fi
chmod 0600 "$SECRETS_FILE" 2>/dev/null || true
if id "$SERVICE_USER" >/dev/null 2>&1; then
    chown "$SERVICE_USER:$SERVICE_GROUP" "$SECRETS_FILE" 2>/dev/null || true
fi
log "Przywrócono pusty szablon $SECRETS_FILE"

# 3) Sieć
if command -v nmcli >/dev/null 2>&1; then
    log "Usuwam zapisane profile WiFi"
    while IFS=: read -r name type; do
        [ -z "$name" ] && continue
        if [ "$type" = "802-11-wireless" ]; then
            nmcli connection delete "$name" >/dev/null 2>&1 || warn "Nie udało się usunąć profilu WiFi: $name"
        fi
    done < <(nmcli -t -f NAME,TYPE connection show 2>/dev/null || true)

    log "Przywracam DHCP dla profili przewodowych"
    while IFS=: read -r name type; do
        [ -z "$name" ] && continue
        if [ "$type" = "802-3-ethernet" ]; then
            nmcli connection modify "$name" \
                ipv4.method auto \
                ipv4.addresses "" \
                ipv4.gateway "" \
                ipv4.dns "" >/dev/null 2>&1 || warn "Nie udało się zresetować profilu Ethernet: $name"
        fi
    done < <(nmcli -t -f NAME,TYPE connection show 2>/dev/null || true)
else
    warn "Brak nmcli, pomijam reset konfiguracji sieci"
fi

schedule_reboot

log "Reset fabryczny zakończony — wyczyszczono data/ i logs/, urządzenie zostanie zrestartowane"
