#!/usr/bin/env bash
# ============================================================
# Backup to Git: Chuan bi du lieu truoc khi auto-sync
# ============================================================
set -euo pipefail

REPO_DIR="/opt/ai-os/products/ceo"
BACKUP_DIR="${REPO_DIR}/backups"
SQL_DIR="${BACKUP_DIR}/sql"
ENC_PASS="020619"

mkdir -p "$SQL_DIR"

# 1. Export SQLite Kanban Boards thanh SQL Text (De Git track duoc khong bi loi nhi phan)
if [ -d "/root/.hermes/kanban/boards" ]; then
  for board_dir in /root/.hermes/kanban/boards/*; do
    if [ -d "$board_dir" ]; then
      bname=$(basename "$board_dir")
      if [ -f "${board_dir}/kanban.db" ]; then
        sqlite3 "${board_dir}/kanban.db" .dump > "${SQL_DIR}/kanban_${bname}.sql" 2>/dev/null || true
      fi
    fi
  done
fi

# 2. Ma hoa .env (chi ma hoa lai khi file goc thay doi de tranh nhay hash)
ENV_SRC="/root/.hermes/.env"
if [ ! -f "$ENV_SRC" ] && [ -f "${REPO_DIR}/.env" ]; then
  ENV_SRC="${REPO_DIR}/.env"
fi

if [ -f "$ENV_SRC" ]; then
  CURRENT_MD5=$(md5sum "$ENV_SRC" | awk '{print $1}')
  LAST_MD5=""
  if [ -f "${BACKUP_DIR}/.env.md5" ]; then
    LAST_MD5=$(cat "${BACKUP_DIR}/.env.md5")
  fi
  
  if [ "$CURRENT_MD5" != "$LAST_MD5" ] || [ ! -f "${REPO_DIR}/.env.enc" ]; then
    openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \
      -in "$ENV_SRC" \
      -out "${REPO_DIR}/.env.enc" \
      -pass pass:"$ENC_PASS" 2>/dev/null || true
    echo "$CURRENT_MD5" > "${BACKUP_DIR}/.env.md5"
  fi
fi

# 3. Dong goi & Ma hoa toan bo Tokens/Secrets cua Hermes (chi khi file goc thay doi)
MD5_LIST=$(cd /root/.hermes && md5sum google_token.json google_client_secret.json auth.json config.yaml channel_directory.json 2>/dev/null || true)
CURRENT_FILES_MD5=$(echo "$MD5_LIST" | md5sum | awk '{print $1}')
LAST_FILES_MD5=""
if [ -f "${BACKUP_DIR}/.secrets_files.md5" ]; then
  LAST_FILES_MD5=$(cat "${BACKUP_DIR}/.secrets_files.md5")
fi

if [ "$CURRENT_FILES_MD5" != "$LAST_FILES_MD5" ] || [ ! -f "${BACKUP_DIR}/secrets.enc" ]; then
  SECRETS_TAR="/tmp/hermes_secrets_temp.tar.gz"
  tar -czf "$SECRETS_TAR" -C "/root/.hermes" \
    google_token.json \
    google_client_secret.json \
    auth.json \
    config.yaml \
    channel_directory.json 2>/dev/null || true

  if [ -f "$SECRETS_TAR" ]; then
    openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \
      -in "$SECRETS_TAR" \
      -out "${BACKUP_DIR}/secrets.enc" \
      -pass pass:"$ENC_PASS" 2>/dev/null || true
    echo "$CURRENT_FILES_MD5" > "${BACKUP_DIR}/.secrets_files.md5"
    rm -f "$SECRETS_TAR"
  fi
fi

# 4. Sao luu danh sach cronjob va Hermes memories
if [ -f "/root/.hermes/cron/jobs.json" ]; then
  cp -f "/root/.hermes/cron/jobs.json" "${BACKUP_DIR}/cron_jobs.json" 2>/dev/null || true
fi

if [ -d "/root/.hermes/memories" ]; then
  mkdir -p "${REPO_DIR}/memories"
  cp -f /root/.hermes/memories/*.md "${REPO_DIR}/memories/" 2>/dev/null || true
fi

# 5. Ghi file goi y mat khau
cat << 'EOF' > "${BACKUP_DIR}/HINT.txt"
Bản sao lưu bảo mật của CEO AI OS
Gợi ý mật khẩu giải mã: "ngày gặp nhau"
Định dạng mật mã: 6 chữ số (DDMMYY)
EOF