#!/bin/sh
{# nocheck: shell-template  grandfathered, values only: the backup directory and the repository list #}

# log command
if [ -n "$SSH_ORIGINAL_COMMAND" ]
then
  echo "$(/bin/date): $SSH_ORIGINAL_COMMAND" | systemd-cat -t "ssh-wrapper.sh"
fi

get_hashed_machine_id="sha256sum /etc/machine-id";
hashed_machine_id="$($get_hashed_machine_id | head -c 64)"
get_backup_types="find {{ DIR_BACKUPS }}/$hashed_machine_id/ -maxdepth 1 -type d -execdir basename {} ;";


backup_types="{{ BACKUP_REPOSITORIES | join(' ') }}"
for backup_type in $backup_types; do
	get_version_directories="ls -d {{ DIR_BACKUPS }}/$hashed_machine_id/$backup_type/*"
	last_version_directory="$($get_version_directories 2>/dev/null | tail -1)"
	case "$SSH_ORIGINAL_COMMAND" in
		"$get_version_directories")
			$get_version_directories
			exit $?
			;;
		"sudo rsync --server --sender "*" . $last_version_directory/")
			# Exception: rsync negotiates version-dependent server flags (3.4.x differs and adds --numeric-ids), so glob them instead of exact-matching a fixed string; allowlist-guard the chars so no shell metacharacter can be injected before running the client's path-constrained command.
			if printf '%s' "$SSH_ORIGINAL_COMMAND" | grep -q '[^ A-Za-z0-9./_=+:-]'; then
				echo "This command is not supported."
				exit 1
			fi
			$SSH_ORIGINAL_COMMAND
			exit $?
			;;
	esac
done

case "$SSH_ORIGINAL_COMMAND" in
	"$get_hashed_machine_id")
		$get_hashed_machine_id
		;;
	"$get_backup_types")
		for backup_type in $backup_types; do
			if [ -d "{{ DIR_BACKUPS }}/$hashed_machine_id/$backup_type" ]; then
				echo "$backup_type"
			fi
		done
		;;
	*)
		echo "This command is not supported."
		exit 1
		;;
esac