#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu

guard_sourcing

#######################################
# Function to generate btrfs-subvolumes.
# Globals:
#   ERR_BTRFS_SUBVOL
#   TARGET
# Arguments:
#   $1: MOUNT_PATH
#   $2: SUBVOLUME
#######################################
create_btrfs_subvolume() {
  declare var_mount_path="$1"
  declare var_subvolume="$2"

  btrfs subvolume create "${TARGET}${var_mount_path}/${var_subvolume}" || {
    do_log "error" "false" "Error occurred at creation of subvolume: '${var_subvolume}' in: '${TARGET}${var_mount_path}'."
    exit "${ERR_BTRFS_SUBVOL}"
  }
  do_log "info" "false" "Created: '${var_subvolume}' at: '${TARGET}${var_mount_path}'."
}

#######################################
# Function to create the mount path and mount the respective device on it.
# Globals:
#   ERR_MOUNTING_DEV
#   TARGET
# Arguments:
#   $1: MOUNT_PATH
#   $2: MOUNT_DEVICE
#   $3: MOUNT_OPTIONS
#######################################
mount_with_dir() {
  declare var_mount_path="$1"
  declare var_mount_device="$2"
  declare var_mount_options="$3"

  if [[ "${var_mount_path}" == "/" ]]; then
    var_mount_path=""
  fi

  mkdir -p "${TARGET}${var_mount_path}"

  mount "${var_mount_options:+-o $var_mount_options}" "${var_mount_device}" "${TARGET}${var_mount_path}" || {
    do_log "error" "false" "Error occurred at mounting '${var_mount_device}' on: '${TARGET}${var_mount_path}'."
    exit "${ERR_MOUNTING_DEV}"
  }
  do_log "info" "false" "Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' incl. options: '${var_mount_options}'."
}

###########################################################################################
# Function for mounting all partitions for debootstrap incl. generating btrfs subvolumes.
# Globals:
#   ERR_MOUNTING_ROOT
#   ERR_NO_DEVIC_PATH
#   ERR_NO_ENCR_LABEL
#   MAP_EPHEMERAL_DEV
#   MAP_MOUNTPATH_DEV
#   MODULE_ERR
#   MODULE_TXT
#   RECIPE_STRING
#   TARGET
# Arguments:
#   None
###########################################################################################
mount_partition() {
  ### 3260_setup_filesystem.sh
  ### Assoziative Array (HashMap) to store Crypt Mapper OR Device for each Mount Path
  ### HMP_MOUNTPATH_DEV["${var_mount_path}"]="/dev/mapper/${var_encryption_label}"
  ### HMP_MOUNTPATH_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"

  ### Mount "/"-filesystem
  declare -r var_mount_path_root="/"
  if [[ -n ${MAP_MOUNTPATH_DEV[$var_mount_path_root]} ]]; then
    mount_with_dir "${var_mount_path_root}" "${MAP_MOUNTPATH_DEV[$var_mount_path_root]}"
  else
    do_log "error" "false" "Root-filesystem '${var_mount_path_root}' not found in Hashmap."
    exit "${ERR_MOUNTING_ROOT}"
  fi

  ### Ensure order of "/boot" and "/boot/efi"
  declare var_path
  for var_path in "/boot" "/boot/efi"; do
    if [[ -n ${MAP_MOUNTPATH_DEV[${var_path}]} ]]; then
      mount_with_dir "${var_path}" "${MAP_MOUNTPATH_DEV[${var_path}]}"
    else
      do_log "info" "false" "Entry '${PATH}' not found in Hashmap."
    fi
  done

  # Mounting all remaining keys of hashmap 'MAP_MOUNTPATH_DEV'.
  declare KEY
  declare TRANSFORMED_STRING
  declare DEVICE_PATH
  declare ENCRYPTION_LABEL
  declare MATCHING_VAR

  for KEY in "${!MAP_MOUNTPATH_DEV[@]}"; do
    # Initialize variables
    DEVICE_PATH="${MAP_MOUNTPATH_DEV[${KEY}]}"

    # if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
    if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$   ]]; then

      TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')

    # if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
    elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then

      # Extract ENCRYPTION_LABEL
      ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"

      # Search matching variable of sourced "${PRESEED}" variable file
      MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")

      if [[ -n ${MATCHING_VAR} ]]; then

        # Extract third, fourth and fifth part of the respective variable
        TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_([^_]+_[^_]+_[^_]+)_.*|\1|')

      else

        do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
        exit "${ERR_NO_ENCR_LABEL}"

      fi

    else

      do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
      exit "${ERR_NO_DEVIC_PATH}"

    fi

    declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
    declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
    declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_encryption_label"
    declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
    declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
    declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
    declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"

    declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
    declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
    declare ENCRYPTION_LABEL=${!ENCRYPTION_LABEL_VAR}
    declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
    declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
    declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
    declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}

    # Skip already mounted paths ("/", "/boot", "/boot/efi")
    if [[ ${KEY} == "/" || ${KEY} == "/boot" || ${KEY} == "/boot/efi" ]]; then
      continue
    fi

    if [[ ${FILESYSTEM_VERSION,,} == "btrfs" ]]; then

      declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
      mount_with_dir "${KEY}" "${DEVICE_PATH}" "${BTRFS_OPTIONS}"
      [[ -n ${MOUNT_SUBVOLUME} ]] && create_btrfs_subvolume "${KEY}" "${MOUNT_SUBVOLUME}"

    elif   [[ ${FILESYSTEM_VERSION,,} == "ext4" ]]; then

      mount_with_dir "${KEY}" "${DEVICE_PATH}"

    else

      do_log "error" "false" "No valid filesystem: '${FILESYSTEM_VERSION}' found for ${KEY}."

    fi

  done

  # Reminder: MAP_EPHEMERALLABEL_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
  # Mounting remaining entries of hashmap 'MAP_EPHEMERALLABEL_DEV'.
  declare KEY
  declare TRANSFORMED_STRING
  declare DEVICE_PATH

  for KEY in "${!MAP_EPHEMERAL_DEV[@]}"; do
    # Initialize variables
    DEVICE_PATH="${MAP_EPHEMERAL_DEV[${KEY}]}"

    # if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
    if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$   ]]; then

      TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')

    # if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
    elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then

      # Extract ENCRYPTION_LABEL
      ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"

      # Search matching variable of sourced "${PRESEED}" variable file
      MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")

      if [[ -n ${MATCHING_VAR} ]]; then

        # Extract third, fourth and fifth part of the respective variable
        TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')

      else

        do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
        exit "${ERR_NO_ENCR_LABEL}"

      fi

    else

      do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
      exit "${ERR_NO_DEVIC_PATH}"

    fi

    declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_encryption_label"
    declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
    declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
    declare ENCRYPTION_LABEL=${!ENCRYPTION_LABEL_VAR}
    declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
    declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}

    if [[ ${KEY} == "SWAP" ]]; then

      cryptsetup open --type plain --key-file /dev/random \
        --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
        --sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${ENCRYPTION_LABEL}"
      mkswap "/dev/mapper/${ENCRYPTION_LABEL}"
      swapon "/dev/mapper/${ENCRYPTION_LABEL}"
      do_log "info" "false" "Mounted: '${KEY}' on: '/dev/mapper/${ENCRYPTION_LABEL}'."

    elif [[ ${KEY} == "/tmp" ]]; then

      cryptsetup open --type plain --key-file /dev/random \
        --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
        --sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${ENCRYPTION_LABEL}"
      mkdir -p "${TARGET}/tmp"
      mount "${MOUNT_OPTIONS:+-o $MOUNT_OPTIONS}" "/dev/mapper/${ENCRYPTION_LABEL}" "${TARGET}/tmp"
      do_log "info" "false" "Mounted: '${KEY}' on: '/dev/mapper/${ENCRYPTION_LABEL}'."

    else
        do_log "warn" "false" "Ephemeral configuration for ${KEY} is not valid or disabled."
    fi

  done

  do_log "info" "false" "All devices of 'MAP_MOUNTPATH_DEV' and 'MAP_EPHEMERALLABEL_DEV' successfully mounted."
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh