#!/usr/bin/env bash
# All privileged calls are dispatched here inside the read-only bwrap sandbox.
set -euo pipefail

name="${0##*/}"
printf '%s' "$name" >> /mnt/calls
printf ' %q' "$@" >> /mnt/calls
printf '\n' >> /mnt/calls

if [[ "$name" == id ]]; then
    if [[ "${SIM_ID_ROOT:-0}" == 1 ]]; then
        case "${1:-}" in
            -un) printf 'root\n' ;;
            -u) printf '0\n' ;;
            *) exit 90 ;;
        esac
    else
        /usr/bin/id "$@"
    fi
    exit
fi

mapped() {
    case "$1" in
        /root/arch-system-restore.*) printf '/mnt/backups%s' "${1#/root}" ;;
        /etc/*|/usr/local/sbin/*) printf '%s' "$1" ;;
        *) printf 'REFUSED destination: %s\n' "$1" >&2; exit 90 ;;
    esac
}

if [[ "$name" == systemctl ]]; then
    action="${1:-}"
    case "$action" in
        cat)
            [[ "${SIM_MISSING_UNIT:-}" != "$2" ]] && grep -Fxq -- "$2" /mnt/units ;;
        is-enabled) printf '%s\n' "${SIM_UNIT_ENABLED:-disabled}" ;;
        is-active) printf '%s\n' "${SIM_UNIT_ACTIVE:-inactive}" ;;
        *) printf 'REFUSED systemctl read: %s\n' "$action" >&2; exit 90 ;;
    esac
    exit
fi

if [[ "$name" == yay ]]; then
    [[ "${1:-}" == -S && "${2:-}" == --needed ]] || exit 90
    [[ "${SIM_FAIL_YAY:-0}" != 1 ]] || exit 41
    exit 0
fi

if [[ "$name" != sudo ]]; then
    printf 'REFUSED direct mutation: %s\n' "$name" >&2
    exit 90
fi

command_name="${1:-}"
shift || true
case "$command_name" in
    -v) exit 0 ;;
    /usr/bin/bash)
        # Reconnaître le fragment fixe sans jamais exécuter le code reçu.
        [[ $# == 4 && "$1" == -c && "$3" == -- ]] || exit 90
        digest="$(printf '%s' "$2" | /usr/bin/sha256sum)"
        [[ "${digest%% *}" == 88a1ea2034ba3685baa35be4404de4089207fd0c781f248d7cbc3f9c56e33b67 ]] || exit 90
        target="$4"
        [[ "$target" == /etc/* || "$target" == /usr/local/sbin/* ]] || exit 90
        count=0
        if [[ "${SIM_INSPECT_TARGET:-}" == "$target" ]]; then
            [[ ! -f /mnt/inspect-count ]] || read -r count < /mnt/inspect-count
            count=$((count + 1))
            printf '%s\n' "$count" > /mnt/inspect-count
            mode="${SIM_INSPECT_MODE:-}"
            if [[ "$mode" == second_fail && "$count" != 2 ]]; then mode=''; fi
            case "$mode" in
                fail) printf 'simulated sudo refusal\n' >&2; exit 1 ;;
                parent_fail) printf 'simulated parent inspection error\n' >&2; exit 3 ;;
                second_fail) printf 'simulated second inspection error\n' >&2; exit 3 ;;
                empty) exit 0 ;;
                unknown) printf 'UNKNOWN\n'; exit 0 ;;
                valid_fail) printf 'EXISTING\n'; exit 1 ;;
                '') ;;
                *) exit 90 ;;
            esac
        fi
        parent="${target%/*}"
        while [[ "$parent" != / ]]; do
            if [[ -L "$parent" ]]; then printf 'LINK\n'; exit 0; fi
            if [[ ! -e "$parent" ]]; then printf 'ABSENT\n'; exit 0; fi
            if [[ ! -d "$parent" ]]; then printf 'INVALID\n'; exit 0; fi
            parent="${parent%/*}"
            [[ -n "$parent" ]] || parent=/
        done
        if [[ -L "$target" ]]; then printf 'LINK\n'
        elif [[ -f "$target" ]]; then printf 'EXISTING\n'
        elif [[ -e "$target" ]]; then printf 'INVALID\n'
        else printf 'ABSENT\n'; fi ;;
    mktemp)
        [[ "$1" == -d && "$2" == '/root/arch-system-restore.XXXXXXXX' ]] || exit 90
        count=0
        [[ ! -f /mnt/counter ]] || read -r count < /mnt/counter
        count=$((count + 1))
        printf '%s\n' "$count" > /mnt/counter
        printf '/root/arch-system-restore.SIM%04d\n' "$count" ;;
    nft)
        [[ "$1" == -c && "$2" == -f && "$3" == /mnt/repo/rootfs/etc/nftables.conf ]] || exit 90
        [[ "${SIM_FAIL_NFT:-0}" != 1 ]] || exit 42 ;;
    visudo)
        [[ "$1" == -cf && "$2" == /tmp/* ]] || exit 90
        [[ "${SIM_FAIL_VISUDO:-0}" != 1 ]] || exit 43
        grep -Fq 'fixtureuser' "$2" ;;
    pacman)
        [[ "$1" == -Syu && "$2" == --needed ]] || exit 90
        [[ "${SIM_FAIL_PACMAN:-0}" != 1 ]] || exit 44 ;;
    systemctl)
        action="${1:-}"
        case "$action" in
            daemon-reload|enable|disable) ;;
            *) exit 90 ;;
        esac
        [[ "${SIM_FAIL_SYSTEMCTL:-}" != "$action" ]] || exit 45 ;;
    tlp)
        [[ "${1:-}" == start ]] || exit 90 ;;
    mkdir)
        [[ "$1" == -p && "$2" == /root/arch-system-restore.* ]] || exit 90
        /usr/bin/mkdir -p -- "$(mapped "$2")" ;;
    cp)
        [[ "$1" == -a && "$2" == -- ]] || exit 90
        src="$3" dest="$(mapped "$4")"
        [[ "$src" == /etc/* || "$src" == /usr/local/sbin/* ]] || exit 90
        /usr/bin/cp -a -- "$src" "$dest" ;;
    install)
        [[ "$1" == -D && "$2" == -m && $# == 5 ]] || exit 90
        mode="$3" src="$4" dest="$5"
        [[ "$src" == /mnt/repo/* || "$src" == /tmp/* || "$src" == /dev/null ]] || exit 90
        [[ "$dest" == /etc/* || "$dest" == /usr/local/sbin/* || "$dest" == /root/arch-system-restore.* ]] || exit 90
        [[ "${SIM_FAIL_INSTALL_TARGET:-}" != "$dest" ]] || exit 46
        if [[ "${SIM_INTERRUPT_TARGET:-}" == "$dest" ]]; then
            signal="${SIM_INTERRUPT_SIGNAL:-TERM}"
            [[ "$signal" == INT || "$signal" == TERM ]] || exit 90
            kill "-$signal" "$PPID"
            [[ "$signal" == INT ]] && exit 130 || exit 143
        fi
        /usr/bin/install -D -m "$mode" "$src" "$(mapped "$dest")" ;;
    *) printf 'REFUSED sudo subcommand: %s\n' "$command_name" >&2; exit 90 ;;
esac