#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

SCRIPT_DIRECTORY="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
PROJECT_ROOT="$(cd -- "$SCRIPT_DIRECTORY/.." && pwd -P)"
DESTINATION_DIRECTORY="${1:-$PROJECT_ROOT/backups}"

ENVIRONMENT_FILE="$PROJECT_ROOT/.env"
CALENDAR_FILE="$PROJECT_ROOT/secrets/calendar_ical_urls.json"
TOKEN_FILE="$PROJECT_ROOT/secrets/organizer_access_token.txt"

for required_file in "$ENVIRONMENT_FILE" "$CALENDAR_FILE" "$TOKEN_FILE"; do
  if [[ ! -f "$required_file" ]]; then
    printf '%s\n' "Required configuration is missing. Run scripts/configure.sh before creating a backup." >&2
    exit 1
  fi
done

command -v tar >/dev/null 2>&1 || { printf '%s\n' "tar is required to create a backup." >&2; exit 1; }
mkdir -p -- "$DESTINATION_DIRECTORY"
DESTINATION_DIRECTORY="$(cd -- "$DESTINATION_DIRECTORY" && pwd -P)"
chmod 700 -- "$DESTINATION_DIRECTORY"

timestamp="$(date -u +%Y%m%d-%H%M%S)"
archive_path="$DESTINATION_DIRECTORY/hobbs-organizer-config-$timestamp.tar.gz"
archive_counter=1
while [[ -e "$archive_path" ]]; do
  archive_path="$DESTINATION_DIRECTORY/hobbs-organizer-config-$timestamp-$archive_counter.tar.gz"
  ((archive_counter += 1))
done

staging_path="$(mktemp -d "$DESTINATION_DIRECTORY/.backup-staging-XXXXXXXX")"
cleanup_staging() {
  [[ -n "${staging_path:-}" && -d "$staging_path" ]] && rm -rf -- "$staging_path"
}
trap cleanup_staging EXIT HUP INT TERM

mkdir -p -- "$staging_path/config" "$staging_path/secrets"
cp -- "$ENVIRONMENT_FILE" "$staging_path/config/environment.env"
cp -- "$CALENDAR_FILE" "$staging_path/secrets/calendar_ical_urls.json"
cp -- "$TOKEN_FILE" "$staging_path/secrets/organizer_access_token.txt"
chmod 600 -- "$staging_path/config/environment.env" "$staging_path/secrets/calendar_ical_urls.json" "$staging_path/secrets/organizer_access_token.txt"
{
  printf '%s\n' 'format=HOBBS_ORGANIZER_CONFIG_BACKUP_V1'
  printf 'created_utc=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
  printf '%s\n' 'contains_secrets=true'
} >"$staging_path/manifest.txt"

(
  cd -- "$staging_path"
  tar -czf "$archive_path" config secrets manifest.txt
)
chmod 600 -- "$archive_path"

rm -rf -- "$staging_path"
staging_path=""
trap - EXIT HUP INT TERM

printf 'Created a protected configuration backup at: %s\n' "$archive_path"
printf '%s\n' "The archive contains secrets. Store it in an encrypted or access-controlled backup system."