#!/bin/bash
set -euo pipefail

LOG_FILE="/var/log/safedns-mdm-collect-logs.log"
STAMP="$(date +%Y%m%d-%H%M%S)"

log() {
 echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

# Проверка root
if [[ $EUID -ne 0 ]]; then
 log "ERROR: must run as root"
 exit 1
fi

# Получаем консольного пользователя (работает при запуске через MDM)
CONSOLE_USER=$(scutil <<< "show State:/Users/ConsoleUser" \
 | awk '/Name :/ { print $3 }')

if [[ -z "$CONSOLE_USER" || "$CONSOLE_USER" == "root" || "$CONSOLE_USER" == "loginwindow" ]]; then
 log "ERROR: no console user found (maybe no one is logged in)"
 exit 1
fi

log "Console user: $CONSOLE_USER"

USER_HOME=$(eval echo "~$CONSOLE_USER")
DESKTOP_DIR="$USER_HOME/Desktop"
mkdir -p "$DESKTOP_DIR"

OUT_FILE="$DESKTOP_DIR/safedns-all-logs-$STAMP.tar.gz"

# ── 1. Файлы как в старом скрипте ──
FILES=(
 "/var/log/com.safedns.agent.SafeDNSMacProxy.postinstall.log"
 "/var/log/safedns.log"
 "/var/log/safedns-bridge-toggle.log"
 "/private/var/root/Library/Group Containers/group.com.safedns.SafeDNSmac/Logs/safedns-unified.log"
 "/private/var/root/Library/Group Containers/group.com.safedns.SafeDNSmac/Logs/unified-log-bridge-state.plist"
 "/var/log/safedns_pf.log"
 "/var/log/safedns_daemon.log"
 "/var/log/safedns-installer.log"
 "/var/log/safedns-daemon.log"
 "/var/log/safedns-daemon.err"
 "/var/log/safedns-daemon-install.log"
 "/var/log/safedns-proxy.log"
 "/Library/Logs/SafeDNS"
 "/tmp/deactivate_dns_proxy.swift"
 "/tmp/check_dns_proxy.swift"
 "/tmp/safedns_deactivate.sh"
)

EXISTING=()
for f in "${FILES[@]}"; do
 [[ -e "$f" ]] && EXISTING+=("$f")
done

# ── 2. Ротированные bridge-файлы (safedns-unified.log.1, .2, ...) ──
BRIDGE_DIR="/private/var/root/Library/Group Containers/group.com.safedns.SafeDNSmac/Logs"
for f in "$BRIDGE_DIR"/safedns-unified.log.*; do
 [[ -f "$f" ]] && EXISTING+=("$f")
done

# ── 3. ПРЯМОЙ ЭКСПОРТ 24 ЧАСА из unified log ──
TMPDIR="/tmp/safedns-collect-$STAMP"
mkdir -p "$TMPDIR"

log "Exporting unified log (DNS Proxy, last 24h)..."
log show --style compact --last 1d \
    --predicate 'subsystem == "com.safedns.agent.SafeDNSMacProxy"' \
    > "$TMPDIR/safedns-unified-24h.log" 2>&1 || true
log "  lines: $(wc -l < "$TMPDIR/safedns-unified-24h.log")"

log "Exporting unified log (Daemon, last 24h)..."
log show --style compact --last 1d \
    --predicate 'subsystem == "com.safedns.agent.SafeDNSDaemon"' \
    > "$TMPDIR/safedns-daemon-unified-24h.log" 2>&1 || true
log "  lines: $(wc -l < "$TMPDIR/safedns-daemon-unified-24h.log")"

EXISTING+=("$TMPDIR/safedns-unified-24h.log")
EXISTING+=("$TMPDIR/safedns-daemon-unified-24h.log")

# ── 4. config.plist ──
CONFIG="/Library/Application Support/SafeDNS/config.plist"
if [[ -f "$CONFIG" ]]; then
    cp "$CONFIG" "$TMPDIR/config.plist"
    EXISTING+=("$TMPDIR/config.plist")
fi

# ── 5. systemextensionsctl ──
systemextensionsctl list > "$TMPDIR/systemextensionsctl.txt" 2>&1 || true
EXISTING+=("$TMPDIR/systemextensionsctl.txt")

# ── 6. Упаковка ──
if [[ ${#EXISTING[@]} -eq 0 ]]; then
 log "ERROR: no files found to archive"
 rm -rf "$TMPDIR"
 exit 1
fi

log "Found ${#EXISTING[@]} files/dirs to archive"
log "Creating archive: $OUT_FILE"

tar -czf "$OUT_FILE" "${EXISTING[@]}"

# Меняем владельца на консольного пользователя
chown "$CONSOLE_USER" "$OUT_FILE"

# Чистим временное
rm -rf "$TMPDIR"

log "Archive created: $OUT_FILE"
log "Owner set to: $CONSOLE_USER"
log "Done"

echo "$OUT_FILE"