#!/bin/bash

###############################################
# 🛡️ union_sec_check.sh — Version avec compteur
# ➕ Notifications Apprise
# 📝 Log dans /var/log/union_sec_check.log
# 📊 Résumé final des modifications
###############################################

DIR="/srv/disk"
LOG_FILE="/var/log/union_sec_check.log"
APPRISE_URL="tgram://6509310953:AAGPUjeRpTyuQZ9rnU62XbMsDQ06sWUYW4M/-1001730456573"
START_TIME=$(date +%s)

touch "$LOG_FILE"
chmod 644 "$LOG_FILE"
exec > >(tee -a "$LOG_FILE") 2>&1

echo "🕒 [$(date '+%F %T')] Lancement de union_sec_check"

notify() {
  local msg="$1"
  echo "[NOTIF] $msg"
  apprise -vv -t "Union sec check" -b "$msg" "$APPRISE_URL"
}

# Initialise les compteurs
count_ownership=0
count_file_perms=0
count_dir_perms=0
count_setgid=0
count_acl=0
count_group_write=0

# 👤 Propriétaire/groupe
echo "🔍 Correction des ownerships..."
for path in "$DIR"*/{series,movies}; do
  [ -d "$path" ] || continue
  modified=$(find "$path" \( -not -user dbi -or -not -group fs_data \) -exec chown dbi:fs_data {} + | wc -l)
  ((count_ownership+=modified))
done
(( count_ownership > 0 )) && notify "Propriétaire/groupe corrigés : $count_ownership"

# 🔐 Droits fichiers
echo "🔍 Correction des droits fichiers (rw)..."
for path in "$DIR"*/{series,movies}; do
  [ -d "$path" ] || continue
  modified=$(find "$path" -type f \( ! -perm -g=rw -or ! -perm -u=rw \) -exec chmod ug+rw {} + | wc -l)
  ((count_file_perms+=modified))
done
(( count_file_perms > 0 )) && notify "Fichiers rw corrigés : $count_file_perms"

# 📁 Droits dossiers
echo "🔍 Correction des droits dossiers (x)..."
for path in "$DIR"*/{series,movies}; do
  [ -d "$path" ] || continue
  modified=$(find "$path" -type d \( ! -perm -g=x -or ! -perm -u=x \) -exec chmod ug+x {} + | wc -l)
  ((count_dir_perms+=modified))
done
(( count_dir_perms > 0 )) && notify "Dossiers x corrigés : $count_dir_perms"

# 🧬 Bit setgid
echo "🔍 Application du bit setgid..."
for path in "$DIR"*/{series,movies}; do
  [ -d "$path" ] || continue
  modified=$(find "$path" -type d ! -perm -2000 -exec chmod g+s {} + | wc -l)
  ((count_setgid+=modified))
done
(( count_setgid > 0 )) && notify "Bit setgid appliqué sur $count_setgid dossiers"

# 🛡️ ACLs
echo "🔍 Application des ACL par défaut..."
for path in "$DIR"*/{series,movies}; do
  [ -d "$path" ] || continue
  count=$(find "$path" -type d | wc -l)
  find "$path" -type d -exec setfacl -d -m u:dbi:rw,g:fs_data:rwX,o::- {} +
  ((count_acl+=count))
done
(( count_acl > 0 )) && notify "ACL appliquées sur $count_acl dossiers"

# ✍️ g+w sur fichiers
echo "🔍 Ajout des droits g+w..."
for path in "$DIR"*/{series,movies}; do
  [ -d "$path" ] || continue
  modified=$(find "$path" -type f ! -perm -g=w -exec chmod g+w {} + | wc -l)
  ((count_group_write+=modified))
done
(( count_group_write > 0 )) && notify "Fichiers g+w corrigés : $count_group_write"

# ✅ Résumé final
END_TIME=$(date +%s)
DURATION=$((END_TIME - START_TIME))

echo ""
echo "📊 Résumé de l'exécution :"
echo "  🔧 Propriétaires/groupes corrigés : $count_ownership"
echo "  📄 Fichiers rw corrigés          : $count_file_perms"
echo "  📁 Dossiers x corrigés           : $count_dir_perms"
echo "  🧬 Dossiers setgid appliqués     : $count_setgid"
echo "  🛡️  ACLs définies sur dossiers    : $count_acl"
echo "  ✍️  Fichiers g+w corrigés         : $count_group_write"
echo ""
echo "✅ Terminé en ${DURATION}s"