#!/bin/bash

TITLE="Nextcloud files"
DESCRIPTION="Mount your Core's Nextcloud files"

# What you entered last time, so running this again starts from it
FILES_CONF="$HOME/.config/miniserver/files.conf"
DAVFS_SECRETS="/etc/davfs2/secrets"
source "$MINISERVER/configure.d/lib/nextcloud.sh"
[ -f "$FILES_CONF" ] && source "$FILES_CONF"

is_installed() {
  command -v mount.davfs
}

# CORE_DOMAIN and CORE_EMAIL come from files.conf; the rest follow
core_names() {
  CORE_USER="${CORE_EMAIL%@*}"
  NEXTCLOUD="https://nextcloud.$CORE_DOMAIN"
  WEBDAV="$NEXTCLOUD/remote.php/dav/files/$CORE_USER"
  MOUNT="/mnt/$CORE_DOMAIN"
}

# The fstab line is added last, after the password is saved
is_configured() {
  [ -n "$CORE_DOMAIN" ] || return 1
  core_names
  grep -qs " $MOUNT davfs " /etc/fstab
}

save_conf() {
  mkdir -p "$(dirname "$FILES_CONF")"
  {
    printf 'CORE_DOMAIN=%q\n' "$CORE_DOMAIN"
    printf 'CORE_EMAIL=%q\n' "$CORE_EMAIL"
  } > "$FILES_CONF"
}

# Mount your Nextcloud files at /mnt/<domain> with davfs2. On a server nobody
# may be logged in, so root mounts it, owned by you, the first time something
# uses it after boot (x-systemd.automount); nofail keeps boot going if
# Nextcloud can't be reached. The password is in davfs2's own secrets file,
# which only root can read, so sandboxed agents can't either.
setup_files() {
  local secret unit

  secret="${APP_PASSWORD//\\/\\\\}"
  secret="${secret//\"/\\\"}"
  sudo sed -i "\\#^$MOUNT #d" "$DAVFS_SECRETS" || return 1
  printf '%s %s "%s"\n' "$MOUNT" "$CORE_USER" "$secret" | sudo tee -a "$DAVFS_SECRETS" > /dev/null || return 1
  sudo chmod 600 "$DAVFS_SECRETS" || return 1

  sudo install -d "$MOUNT" || return 1
  if ! grep -qs " $MOUNT davfs " /etc/fstab; then
    echo "$WEBDAV $MOUNT davfs rw,uid=$(id -u),gid=$(id -g),_netdev,nofail,x-systemd.automount 0 0" \
      | sudo tee -a /etc/fstab > /dev/null || return 1
  fi
  sudo systemctl daemon-reload || return 1

  # Start the automount now rather than at the next boot, then use it once so
  # a wrong address or password shows up here. Unmount first when running
  # again, so a new password is used.
  unit="$(systemd-escape --path "$MOUNT")"
  if ! sudo systemctl stop "$unit.mount"; then
    echo "$MOUNT is in use; close what's using it and run: configure files"
    return 1
  fi
  sudo systemctl restart "$unit.automount" || return 1
  if ! ls "$MOUNT" > /dev/null; then
    echo "Couldn't mount $WEBDAV; see: journalctl -u $unit.mount"
    return 1
  fi
  echo "Your Nextcloud files are at $MOUNT."
}

run_configure() {
  local url tries

  read -erp "Your Superpanel's address (e.g. https://superpanel.example.com): " \
    -i "${CORE_DOMAIN:+https://superpanel.$CORE_DOMAIN}" url
  url="${url#*://}"
  url="${url%%/*}"
  CORE_DOMAIN="${url#superpanel.}"
  [ -n "$CORE_DOMAIN" ] || { echo "That isn't an address."; return 1; }

  read -erp "Your Core email: " -i "${CORE_EMAIL:-$USER@$CORE_DOMAIN}" CORE_EMAIL
  [[ "$CORE_EMAIL" == *@* ]] || { echo "That isn't an email address."; return 1; }
  core_names
  save_conf

  # The mount gets an app password, not your Core password
  for tries in 1 2 3; do
    read -rsp "Your Core password: " PASSWORD
    echo
    nextcloud_app_password "MiniServer on $HOSTNAME"
    case $? in
      0) break ;;
      2) echo "Nextcloud says that password is wrong." ;;
      *) echo "Couldn't reach Nextcloud at $NEXTCLOUD."; unset PASSWORD; return 1 ;;
    esac
  done
  unset PASSWORD
  [ -n "$APP_PASSWORD" ] || return 1

  setup_files
  local status=$?
  unset APP_PASSWORD
  return $status
}