vaultik/internal/cli/snapshot.go

package cli

import (
	"errors"
	"fmt"

	"github.com/spf13/cobra"
	"sneak.berlin/go/vaultik/internal/log"
	"sneak.berlin/go/vaultik/internal/vaultik"
)

var (
	errSnapshotIDRequired  = errors.New("snapshot ID required")
	errWrongArgCount       = errors.New("wrong argument count")
	errPurgeCriteriaNeeded = errors.New(
		"must specify either --keep-latest or --older-than")
	errPurgeCriteriaBoth = errors.New(
		"cannot specify both --keep-latest and --older-than")
)

// requireSnapshotIDArg validates that exactly one positional argument
// (the snapshot ID) was supplied, printing help otherwise.
func requireSnapshotIDArg(cmd *cobra.Command, args []string) error {
	if len(args) != 1 {
		_ = cmd.Help()

		if len(args) == 0 {
			return errSnapshotIDRequired
		}

		return fmt.Errorf("%w: expected 1 argument, got %d",
			errWrongArgCount, len(args))
	}

	return nil
}

// NewSnapshotCommand creates the snapshot command and subcommands
func NewSnapshotCommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:   "snapshot",
		Short: "Snapshot management commands",
		Long:  "Commands for creating, listing, and managing snapshots",
		// cobra checks Args only on a command that has a Run: without
		// one, a mistyped subcommand printed help and exited 0.
		Args: cobra.NoArgs,
		Run: func(cmd *cobra.Command, _ []string) {
			_ = cmd.Help()
		},
	}

	// Add subcommands
	cmd.AddCommand(newSnapshotCreateCommand())
	cmd.AddCommand(newSnapshotListCommand())
	cmd.AddCommand(newSnapshotPurgeCommand())
	cmd.AddCommand(newSnapshotVerifyCommand())
	cmd.AddCommand(newSnapshotRemoveCommand())
	cmd.AddCommand(newSnapshotRestoreCommand())

	return cmd
}

// newSnapshotCreateCommand creates the 'snapshot create' subcommand
func newSnapshotCreateCommand() *cobra.Command {
	opts := &vaultik.SnapshotCreateOptions{}

	cmd := &cobra.Command{
		Use:   "create [snapshot-names...]",
		Short: "Create new snapshots",
		Long: `Creates new snapshots of the configured directories.

If snapshot names are provided, only those snapshots are created.
If no names are provided, all configured snapshots are created.

The config is read from the path given by --config or VAULTIK_CONFIG;
otherwise from the platform config directory (~/.config/vaultik/config.yml
on Linux), then /etc/vaultik/config.yml.`,
		Args: cobra.ArbitraryArgs,
		RunE: func(cmd *cobra.Command, args []string) error {
			err := opts.Validate()
			if err != nil {
				return err
			}

			// Pass snapshot names from args
			opts.Snapshots = args
			// --skip-errors is a global flag on the root command.
			opts.SkipErrors = rootFlags.SkipErrors
			// Use unified config resolution
			configPath, err := ResolveConfigPath()
			if err != nil {
				return err
			}

			// Use the backup functionality from cli package
			rootFlags := GetRootFlags()

			// --cron suppression is wired through v.UI by setupGlobals.
			return RunOperation(cmd.Context(), AppOptions{
				ConfigPath: configPath,
				LogOptions: log.Options{
					Verbose: rootFlags.Verbose,
					Debug:   rootFlags.Debug,
					Cron:    opts.Cron,
					Quiet:   rootFlags.Quiet,
				},
				Mode: mutating,
			}, func(v *vaultik.Vaultik) error {
				return v.CreateSnapshot(opts)
			}, func(err error) {
				if errors.Is(err, vaultik.ErrPostBackupPruneFailed) {
					log.Error("Post-backup prune failed", "error", err)
					ReportErrorf("Backup completed, but %v", err)

					return
				}

				if errors.Is(err, vaultik.ErrFilesUnreadable) {
					log.Error("Backup completed with unreadable files", "error", err)
					ReportErrorf("Backup completed, but %v", err)

					return
				}

				log.Error("Snapshot creation failed", "error", err)
				ReportErrorf("Snapshot creation failed: %v", err)
			})
		},
	}

	cmd.Flags().BoolVar(&opts.Cron, "cron", false,
		"Run in cron mode (silent unless warning or error)")
	cmd.Flags().BoolVar(&opts.Prune, "prune", false,
		"After backup, drop older snapshots of the same name and remove "+
			"orphaned blobs older than prune_grace_period (not after a "+
			"backup that skipped unreadable files)")
	cmd.Flags().StringVar(&opts.KeepNewerThan, "keep-newer-than", "",
		"With --prune: keep snapshots newer than this duration "+
			"(e.g. 30d, 4w, 6mo, 1y; m is minutes, mo is months) "+
			"instead of only the latest")

	return cmd
}

// newSnapshotListCommand creates the 'snapshot list' subcommand
func newSnapshotListCommand() *cobra.Command {
	var jsonOutput bool

	cmd := &cobra.Command{
		Use:     "list",
		Aliases: []string{"ls"},
		Short:   "List all snapshots",
		Long:    "Lists all snapshots with their ID, timestamp, and compressed size",
		Args:    cobra.NoArgs,
		RunE: func(cmd *cobra.Command, _ []string) error {
			return runVaultikApp(cmd, readOnly, false,
				"Failed to list snapshots",
				func(v *vaultik.Vaultik) error {
					return v.ListSnapshots(jsonOutput)
				})
		},
	}

	cmd.Flags().BoolVar(&jsonOutput, "json", false, "Output in JSON format")

	return cmd
}

// newSnapshotPurgeCommand creates the 'snapshot purge' subcommand
func newSnapshotPurgeCommand() *cobra.Command {
	opts := &vaultik.SnapshotPurgeOptions{}

	cmd := &cobra.Command{
		Use:   "purge",
		Short: "Purge old snapshots",
		Long: `Removes snapshots based on age or count criteria.

Retention is per-snapshot-name: --keep-latest keeps the latest of each
configured snapshot name, not the latest globally. Use --snapshot to
restrict the operation to specific snapshot names.`,
		Args: cobra.NoArgs,
		RunE: func(cmd *cobra.Command, _ []string) error {
			// Validate flags
			if !opts.KeepLatest && opts.OlderThan == "" {
				return errPurgeCriteriaNeeded
			}

			if opts.KeepLatest && opts.OlderThan != "" {
				return errPurgeCriteriaBoth
			}

			return runVaultikApp(cmd, mutating, false,
				"Failed to purge snapshots",
				func(v *vaultik.Vaultik) error {
					return v.PurgeSnapshotsWithOptions(opts)
				})
		},
	}

	cmd.Flags().BoolVar(&opts.KeepLatest, "keep-latest", false,
		"Keep only the latest snapshot of each name")
	cmd.Flags().StringVar(&opts.OlderThan, "older-than", "",
		"Remove snapshots older than duration "+
			"(e.g. 30d, 4w, 6mo, 1y; m is minutes, mo is months)")
	cmd.Flags().BoolVar(&opts.Force, "force", false, "Skip confirmation prompt")
	cmd.Flags().StringArrayVar(&opts.Names, "snapshot", nil,
		"Restrict to snapshots with these names (repeat for multiple)")

	return cmd
}

// newSnapshotVerifyCommand creates the 'snapshot verify' subcommand
func newSnapshotVerifyCommand() *cobra.Command {
	opts := &vaultik.VerifyOptions{}

	cmd := &cobra.Command{
		Use:   "verify <snapshot-id>",
		Short: "Check a snapshot's blobs are present with the listed size",
		Long: "Checks that every blob the snapshot's manifest lists is present\n" +
			"in storage with the size the manifest records, and that the\n" +
			"snapshot's encrypted database is present. It does not read blob\n" +
			"contents; use --deep to download, decrypt, and re-hash every blob\n" +
			"to detect corruption -- integrity, not who wrote it.\n\n" +
			"The snapshot may be named by its ID or, on a host with no local\n" +
			"index, by the remote key that 'snapshot list' prints for a\n" +
			"remote-only snapshot (an unambiguous leading part is enough).",
		Args: requireSnapshotIDArg,
		RunE: func(cmd *cobra.Command, args []string) error {
			snapshotID := args[0]

			// Use unified config resolution
			configPath, err := ResolveConfigPath()
			if err != nil {
				return err
			}

			rootFlags := GetRootFlags()

			return RunOperation(cmd.Context(), AppOptions{
				ConfigPath: configPath,
				LogOptions: log.Options{
					Verbose: rootFlags.Verbose,
					Debug:   rootFlags.Debug,
					Quiet:   rootFlags.Quiet,
					JSON:    opts.JSON,
				},
				Mode: readOnly,
			}, func(v *vaultik.Vaultik) error {
				return v.VerifySnapshotWithOptions(snapshotID, opts)
			}, func(err error) {
				if opts.JSON {
					return
				}

				log.Error("Verification failed", "error", err)
				ReportErrorf("Verification failed: %v", err)
			})
		},
	}

	cmd.Flags().BoolVar(&opts.Deep, "deep", false, "Download and verify blob hashes")
	cmd.Flags().BoolVar(&opts.JSON, "json", false, "Output verification results as JSON")

	return cmd
}

// newSnapshotRemoveCommand creates the 'snapshot remove' subcommand
func newSnapshotRemoveCommand() *cobra.Command {
	opts := &vaultik.RemoveOptions{}

	cmd := &cobra.Command{
		Use:     "remove <snapshot-id>",
		Aliases: []string{"rm"},
		Short:   "Remove a snapshot from local index and remote metadata",
		Long: `Removes a snapshot.

By default, this removes the snapshot from the local index database and
strips the snapshot's metadata from the backup destination store. Blobs
are NOT touched: deleting them requires reading every remaining remote
manifest (the destination store may hold snapshots this host doesn't
know about), which is what 'vaultik prune' does. The command prints the
'vaultik prune' invocation to run as a follow-up only when it removed the
snapshot's metadata from the destination store, and never under --json.

An ID that names no snapshot in the local index or on the destination
store is an error.

Use --local-only to skip the remote half (e.g. when you want to forget a
snapshot locally without touching the destination store); the snapshot
must then be in the local index.

If removing the snapshot's metadata from the destination store fails (for
example because the remote is unreachable), the local-database removal
still completes and a warning is emitted; run 'vaultik snapshot remove
<snapshot-id>' again once the destination store is reachable to remove
the snapshot's metadata from it ('vaultik prune' does not). For a
snapshot that is only on the destination store, that failure is an error.

To wipe the entire destination store and start over, use 'vaultik remote
nuke --force' — it is the single supported entry point for that.`,
		Args: requireSnapshotIDArg,
		RunE: func(cmd *cobra.Command, args []string) error {
			return runVaultikApp(cmd, mutating, opts.JSON,
				"Failed to remove snapshot",
				func(v *vaultik.Vaultik) error {
					_, err := v.RemoveSnapshot(args[0], opts)

					return err
				})
		},
	}

	cmd.Flags().BoolVarP(&opts.Force, "force", "f", false, "Skip confirmation prompt")
	cmd.Flags().BoolVar(&opts.DryRun, "dry-run", false,
		"Show what would be removed without removing")
	cmd.Flags().BoolVar(&opts.JSON, "json", false,
		"Output result as JSON; skips the confirmation prompt, as --force does")
	cmd.Flags().BoolVar(&opts.LocalOnly, "local-only", false,
		"Skip remote cleanup; only touch the local index")

	return cmd
}