config_bootstrap.go

// SPDX-License-Identifier: AGPL-3.0
package main

import (
	"crypto/rand"
	_ "embed"
	"encoding/hex"
	"fmt"
	"os"
	"path/filepath"
	"regexp"
	"strings"
)

//go:embed config.example.toml
var defaultConfigTemplate string

var (
	rePepper = regexp.MustCompile(`(?m)^pepper\s*=\s*".*"`)
	reKeyHex = regexp.MustCompile(`(?m)^key_hex\s*=\s*".*"`)
	reGitBin = regexp.MustCompile(`(?m)^bin\s*=\s*".*"`)
)

// detectGitBinary returns the git path to write into a generated config.
// Termux must be handled explicitly: Android's seccomp policy rejects the
// syscall used by PATH lookup, and the desktop path /usr/bin/git does not
// exist there.
func detectGitBinary() string {
	termuxPaths := []string{
		"/data/data/com.termux/files/usr/bin/git",
		"/data/data/com.termux/files/usr/local/bin/git",
	}
	if _, err := os.Stat("/data/data/com.termux"); err == nil ||
		strings.HasPrefix(os.Getenv("PREFIX"), "/data/data/com.termux/") {
		for _, p := range termuxPaths {
			if info, err := os.Stat(p); err == nil && !info.IsDir() && info.Mode().Perm()&0o111 != 0 {
				return p
			}
		}
		return "" // let gitcmd report a clear, non-panicking error at startup
	}
	for _, p := range []string{"/usr/bin/git", "/usr/local/bin/git", "/bin/git"} {
		if info, err := os.Stat(p); err == nil && !info.IsDir() && info.Mode().Perm()&0o111 != 0 {
			return p
		}
	}
	return ""
}

// ensureConfigFile creates configPath from the embedded template when it is
// missing, then fills in freshly generated secrets. It reports whether the
// file was created so the caller can tell the user exactly once.
func ensureConfigFile(configPath string) (created bool, err error) {
	if configPath == "" {
		return false, nil
	}
	_, statErr := os.Stat(configPath)
	if statErr == nil {
		return false, nil
	}
	if !os.IsNotExist(statErr) {
		return false, fmt.Errorf("检查配置文件 %s: %w", configPath, statErr)
	}
	if dir := filepath.Dir(configPath); dir != "" && dir != "." {
		if err := os.MkdirAll(dir, 0o750); err != nil {
			return false, fmt.Errorf("创建配置目录 %s: %w", dir, err)
		}
	}
	pepper, err := randomHex(32)
	if err != nil {
		return false, err
	}
	key, err := randomHex(32)
	if err != nil {
		return false, err
	}
	content := rePepper.ReplaceAllString(defaultConfigTemplate, `pepper = "`+pepper+`"`)
	content = reKeyHex.ReplaceAllString(content, `key_hex = "`+key+`"`)
	if gitBin := detectGitBinary(); gitBin != "" {
		content = reGitBin.ReplaceAllString(content, `bin = "`+gitBin+`"`)
	}
	content = strings.ReplaceAll(content, "# 复制为 config.toml 后按需修改：cp config.example.toml config.toml\n#",
		"# 本文件由 gitli 首次启动自动生成，可直接编辑。\n#")
	if err := os.WriteFile(configPath, []byte(content), 0o600); err != nil {
		return false, fmt.Errorf("写入配置文件 %s: %w", configPath, err)
	}
	return true, nil
}

// ensureSecret fills a missing secret in an existing config file so an upgrade
// from an older generated file still ends up with working encryption.
func ensureSecret(configPath, kind string) (string, error) {
	re := rePepper
	if kind == "key_hex" {
		re = reKeyHex
	}
	value, err := randomHex(32)
	if err != nil {
		return "", err
	}
	raw, err := os.ReadFile(configPath)
	if err != nil {
		return "", err
	}
	updated := re.ReplaceAllString(string(raw), kind+` = "`+value+`"`)
	if updated == string(raw) {
		return "", fmt.Errorf("配置文件中找不到 %s 字段", kind)
	}
	info, err := os.Stat(configPath)
	mode := os.FileMode(0o600)
	if err == nil {
		mode = info.Mode().Perm()
	}
	if err := os.WriteFile(configPath, []byte(updated), mode); err != nil {
		return "", err
	}
	return value, nil
}

// ensureConfiguredSecrets backfills encryption secrets in an existing config
// file. Environment variables still win, so this only handles the common case
// of a file generated by an older version.
func ensureConfiguredSecrets(configPath string) error {
	if configPath == "" {
		return nil
	}
	if os.Getenv("GITLI_PEPPER") == "" || os.Getenv("GITLI_CRYPTO_KEY") == "" {
		raw, err := os.ReadFile(configPath)
		if err != nil {
			return nil
		}
		if os.Getenv("GITLI_PEPPER") == "" && regexp.MustCompile(`(?m)^pepper\s*=\s*""\s*$`).Match(raw) {
			if _, err := ensureSecret(configPath, "pepper"); err != nil {
				return err
			}
			fmt.Println("config.toml 缺少 pepper，已自动生成并写回。")
		}
		if os.Getenv("GITLI_CRYPTO_KEY") == "" && regexp.MustCompile(`(?m)^key_hex\s*=\s*""\s*$`).Match(raw) {
			if _, err := ensureSecret(configPath, "key_hex"); err != nil {
				return err
			}
			fmt.Println("config.toml 缺少加密密钥，已自动生成并写回。")
		}
	}
	return nil
}

func randomHex(n int) (string, error) {
	buf := make([]byte, n)
	if _, err := rand.Read(buf); err != nil {
		return "", fmt.Errorf("生成随机密钥: %w", err)
	}
	return hex.EncodeToString(buf), nil
}