felhom-controller/controller/internal/backup/tier2_restore.go

package backup

import (
	"context"
	"errors"
	"fmt"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"time"
)

// Tier-2 in-place file restore (TASK C2, closes drill finding F2): the customer-facing recovery for
// class-C data — HDD bind-mount user files under appdata/<stack>. Restores MISSING files from the
// recorded Tier-2 copy back into the live appdata dir, and touches NOTHING else:
//
//   - a file that exists live is NEVER overwritten (a customer edit after the last Tier-2 run wins);
//   - a live file absent from the backup is NEVER deleted (that is what rsyncMirror's --delete would
//     do in this direction — the catastrophic trap this helper exists to avoid);
//   - only files present in the copy and missing live are copied back (attrs preserved).
//
// This exactly serves the "I deleted my files" scenario. Corruption / point-in-time rollback stays
// with the offbox restore-to-verify + operator paths — deliberately out of scope.

// Refusal reasons (customer-readable — they surface verbatim in the flash message).
var (
	errNoTier2Copy       = errors.New("nincs másodlagos fájlmásolat ehhez az alkalmazáshoz")
	errTier2DriveGone    = errors.New("a másodlagos meghajtó nincs csatlakoztatva")
	errLiveDriveGone     = errors.New("az alkalmazás meghajtója nincs csatlakoztatva")
	errLiveDriveDecommed = errors.New("az alkalmazás meghajtója le van szerelve")
	// errTier2OldLayout (3b, §7-G2): the recorded copy predates the v2 relpath-mirroring layout (no
	// marker). Refuse rather than read a flat layout we no longer understand — safe, because tier-2
	// restore is missing-file recovery and the live data still exists in that scenario.
	errTier2OldLayout = errors.New("A 2. mentés régi formátumú — futtass előbb egy új másodlagos mentést.")
)

// RestoreTier2Files restores the app's MISSING user files in place from its recorded Tier-2 copy
// (additive-only; see the package comment above). Returns how many regular files were copied back.
//
// The source is the RECORDED Tier-2 destination (settings.CrossDriveBackup.DestinationPath) — never
// a fresh selectTier2Target, which could re-pick a different (empty) drive and "restore" nothing.
// All refusals happen BEFORE the app is stopped. Stop-first is the locked consistency policy: the
// app must not be reorganizing its data dir mid-copy.
func (m *Manager) RestoreTier2Files(stackName string) (filesRestored int, err error) {
	if m.stackProvider == nil {
		return 0, fmt.Errorf("stack provider not configured")
	}
	if err := m.acquireRunning(); err != nil {
		return 0, err // shares the backup/restore single-flight — must not race a running backup
	}
	defer m.releaseRunning()

	// Live side: the app's drive must be present and in service.
	drive := m.GetAppDrivePath(stackName)
	if drive == "" || !filepath.IsAbs(drive) {
		return 0, fmt.Errorf("cannot determine drive path for %s", stackName)
	}
	if m.settings != nil {
		if m.settings.IsDisconnected(drive) {
			return 0, fmt.Errorf("%w (%s)", errLiveDriveGone, drive)
		}
		if m.settings.IsDecommissioned(drive) {
			return 0, fmt.Errorf("%w (%s)", errLiveDriveDecommed, drive)
		}
	}
	// v2 relpath-mirroring: liveNsRoot == the app's HDD_PATH (Model A). The dest hdd/ and userdata/
	// subtrees mirror the live relpath structure exactly, so restore is two whole-subtree merges (N>1
	// dirs + nested binds handled natively — no per-appdata-dir resolution, no N>1 refusal).
	liveNsRoot := m.namespaceRoot(drive)

	// Source side: the RECORDED Tier-2 copy must exist, its drive connected, and it must be v2.
	var destBase string
	if m.settings != nil {
		if cfg := m.settings.GetCrossDriveConfig(stackName); cfg != nil && cfg.LastRun != "" && cfg.DestinationPath != "" {
			if m.settings.IsDisconnected(cfg.DestinationPath) {
				return 0, errTier2DriveGone
			}
			destBase = filepath.Join(cfg.DestinationPath, "backups", "secondary", stackName)
		}
	}
	if destBase == "" {
		return 0, errNoTier2Copy
	}
	if _, statErr := os.Stat(destBase); statErr != nil {
		return 0, errNoTier2Copy // recorded but the copy dir is gone — same honest refusal
	}
	// §7-G2 marker gate: a pre-v2 (flat) copy has no marker → refuse rather than read a layout we no
	// longer understand (live data still exists for missing-file recovery).
	if _, mErr := os.Stat(filepath.Join(destBase, tier2LayoutMarker)); mErr != nil {
		return 0, errTier2OldLayout
	}

	copier := m.restoreFilesCopier
	if copier == nil {
		copier = rsyncRestoreMissing
	}

	// The two v2 subtree merges: destBase/hdd/<rel> ↔ liveNsRoot/<rel>;
	// destBase/userdata/<rel> ↔ liveNsRoot/userdata/<rel>. Each missing-only, additive.
	merges := []struct{ src, dst string }{
		{filepath.Join(destBase, "hdd"), liveNsRoot},
		{filepath.Join(destBase, "userdata"), filepath.Join(liveNsRoot, "userdata")},
	}
	m.logger.Printf("[INFO] [backup] Tier-2 file restore for %s: %s (v2) → %s (additive-only)", stackName, destBase, liveNsRoot)

	// Stop → copy → start → health (the standard restore shape; F17: errors surface, never swallowed).
	if stopErr := m.stackProvider.StopStack(stackName); stopErr != nil {
		m.logger.Printf("[WARN] [backup] could not stop %s before Tier-2 file restore: %v (continuing)", stackName, stopErr)
	}
	start := time.Now()
	var copyErr error
	for _, mg := range merges {
		if _, err := os.Stat(mg.src); err != nil {
			continue // that subtree is absent in this copy (e.g. no userdata legs) — skip
		}
		n, err := copier(mg.src, mg.dst)
		filesRestored += n
		if err != nil {
			copyErr = err
			break
		}
	}
	startErr := m.stackProvider.StartStack(stackName)
	if startErr != nil {
		m.logger.Printf("[ERROR] [backup] failed to restart %s after Tier-2 file restore: %v", stackName, startErr)
	}
	if healthErr := m.waitForHealthy(stackName, 90*time.Second); healthErr != nil {
		m.logger.Printf("[WARN] [backup] %s Tier-2 file restore done but health check failed: %v", stackName, healthErr)
	}

	if copyErr != nil {
		return filesRestored, fmt.Errorf("fájlmásolás sikertelen: %w", copyErr)
	}
	if startErr != nil {
		return filesRestored, fmt.Errorf("%d fájl visszaállítva, de az alkalmazás újraindítása sikertelen: %w", filesRestored, startErr)
	}
	// Privacy: count + duration only — customer file names never at INFO.
	m.logger.Printf("[INFO] [backup] Tier-2 file restore completed for %s: %d file(s) restored (%s)",
		stackName, filesRestored, time.Since(start).Round(time.Second))
	return filesRestored, nil
}

// rsyncRestoreMissing copies the files MISSING from dst back from src, and nothing else:
// `rsync -a --ignore-existing` — existing dst files are never overwritten, and (unlike rsyncMirror,
// which carries --delete for the backup direction) nothing at dst is ever deleted. Returns the
// number of regular files transferred, counted from --itemize-changes output.
func rsyncRestoreMissing(src, dst string) (int, error) {
	if err := os.MkdirAll(dst, 0755); err != nil {
		return 0, fmt.Errorf("mkdir %s: %w", dst, err)
	}
	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Minute)
	defer cancel()
	// Trailing slashes: copy the CONTENTS of src into dst (same shape as rsyncMirror).
	cmd := exec.CommandContext(ctx, "rsync", "-a", "--ignore-existing", "--itemize-changes",
		strings.TrimRight(src, "/")+"/", strings.TrimRight(dst, "/")+"/")
	out, err := cmd.CombinedOutput()
	if err != nil {
		return 0, fmt.Errorf("%v: %s", err, strings.TrimSpace(string(out)))
	}
	return countRestoredFiles(string(out)), nil
}

// countRestoredFiles counts the itemize-changes lines that mark a TRANSFERRED regular file (">f…").
// Created dirs ("cd…") and symlinks ("cL…") are not counted — the flash reports files. Pure
// (unit-tested without rsync).
func countRestoredFiles(itemizedOut string) int {
	n := 0
	for _, line := range strings.Split(itemizedOut, "\n") {
		if strings.HasPrefix(line, ">f") {
			n++
		}
	}
	return n
}