#!/bin/bash
################################################################################
# Script Name: version/2.1.26/UPDATE.sh
# Description: The security release. Nothing to migrate; something to check.
# Company: hitechcloud.org
# Copyright (c) hitechcloud.org
################################################################################
#
# 2.1.26 is binaries and dependencies: a Go 1.27.1 rebuild that clears 52
# reachable standard-library advisories across the two panels, eight npm
# advisories in the webmail, and a CSRF origin check moved in front of the
# exemptions that were skipping it. None of that needs a schema change, a
# configuration change or a new module - so this script migrates nothing.
#
# What it does instead is check that the update actually replaced what it
# claimed to. A security release whose binaries did not get installed is worse
# than no release, because the version file then says the server is patched.
################################################################################

set -uo pipefail

GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
ok()   { echo -e "[2.1.26] ${GREEN}✓${NC} $*"; }
warn() { echo -e "[2.1.26] ${YELLOW}!${NC} $*" >&2; }

[[ $EUID -eq 0 ]] || { echo "[2.1.26] This update must run as root." >&2; exit 1; }

# 1. The binaries carry the fix, so they are what has to have changed.
for binary in hitechcloud hitechadmin; do
    path="/usr/local/bin/${binary}"
    if [[ ! -x "$path" ]]; then
        warn "${path} is missing - this server is not patched."
        continue
    fi
    got=$("$path" --version 2>/dev/null | tr -d '[:space:]')
    if [[ "$got" == "2.1.26" ]]; then
        ok "${binary} reports 2.1.26"
    else
        warn "${binary} reports '${got}', not 2.1.26 - the security fixes are NOT in force. Run: hitechcloudcli update --force"
    fi
done

# 2. The webmail's fixes are in its own dependencies, which means they arrive
#    only if the webmail was actually rebuilt. That rebuild is part of an
#    update from 2.1.25 onward; a server coming from anything older was updated
#    by a script that walked straight past the webmail, so it is worth saying
#    out loud rather than assuming.
if systemctl list-unit-files 2>/dev/null | grep -q '^hitechcloud-webmail\.service'; then
    if [[ "$(systemctl is-active hitechcloud-webmail 2>/dev/null)" == active ]]; then
        ok "Webmail is running"
    else
        warn "The webmail is not running: systemctl status hitechcloud-webmail"
    fi
    installed=$(node -e "console.log(require('/opt/hitechcloud/mailflow/backend/node_modules/nodemailer/package.json').version)" 2>/dev/null)
    case "$installed" in
        9.1.*|9.[2-9]*|[1-9][0-9]*) ok "Webmail is on the patched nodemailer (${installed})" ;;
        "")  warn "Could not read the webmail's nodemailer version - check it was rebuilt: hitechcloudcli native-webmail update" ;;
        *)   warn "The webmail is still on nodemailer ${installed}; the mail advisories are not fixed there. Run: hitechcloudcli native-webmail update" ;;
    esac
fi

ok "2.1.26 update complete"
exit 0