rebreak-monorepo/ops/mdm/supervise-magic/internal/supervise/flow_backup.go

// MobileBackup2-Pfad für Re-Supervise auf already-supervised Devices.
// Wird automatisch von Supervise() gewählt wenn Device schon supervised + --force.
package supervise

import (
	"errors"
	"fmt"
	"time"

	"github.com/google/uuid"

	"github.com/raynis/rebreak-supervise-magic/internal/afclock"
	"github.com/raynis/rebreak-supervise-magic/internal/cert"
	"github.com/raynis/rebreak-supervise-magic/internal/cloudconfig"
	"github.com/raynis/rebreak-supervise-magic/internal/device"
	"github.com/raynis/rebreak-supervise-magic/internal/mobilebackup2"
	"github.com/raynis/rebreak-supervise-magic/internal/notification_proxy"
)

// SuperviseViaBackup nutzt den MobileBackup2-Restore-Trick. Funktioniert
// auch auf already-supervised Devices (umgeht Apple's 14002-Check via
// "scheinbarer Restore" + DEP-mode CloudConfigurationDetails).
func SuperviseViaBackup(udid string, opts Options) error {
	logf := makeLogger(opts.Verbose)

	logf("[backup-flow] step 1/8: connecting ...")
	conn, err := device.Connect(udid)
	if err != nil {
		return fmt.Errorf("step 1: %w", err)
	}
	defer conn.Close()
	info, err := conn.Info()
	if err != nil {
		return fmt.Errorf("step 1: info: %w", err)
	}

	logf("[backup-flow] step 2/8: loading supervision identity ...")
	id, err := cert.LoadOrCreate()
	if err != nil {
		return fmt.Errorf("step 2: %w", err)
	}
	logf("  ✓ cert %d bytes", len(id.CertDER))

	logf("[backup-flow] step 3/8: building backup files ...")
	now := time.Now()
	vars := mobilebackup2.TemplateVars{
		BackupUUID:     uuid.New().String(),
		BackupGUID:     uuid.New().String(),
		Date:           mobilebackup2.FormatBackupDate(now),
		BuildVersion:   asString(info["BuildVersion"]),
		ProductType:    asString(info["ProductType"]),
		ProductVersion: asString(info["ProductVersion"]),
		SerialNumber:   asString(info["SerialNumber"]),
		UDID:           udid,
		DeviceName:     asString(info["DeviceName"]),
	}

	cloudCfg, err := cloudconfig.Build(cloudconfig.BuildOptions{
		OrganizationName: opts.OrgName,
		SupervisorCert:   id.CertDER,
	})
	if err != nil {
		return fmt.Errorf("step 3: cloudconfig: %w", err)
	}
	logf("  ✓ CloudConfigurationDetails.plist: %d bytes", len(cloudCfg))

	statusPlist, err := mobilebackup2.RenderStatusPlist(vars)
	if err != nil {
		return fmt.Errorf("step 3: status: %w", err)
	}
	infoPlist, err := mobilebackup2.RenderInfoPlist(vars)
	if err != nil {
		return fmt.Errorf("step 3: info: %w", err)
	}
	manifestPlist, err := mobilebackup2.RenderManifestPlist(vars)
	if err != nil {
		return fmt.Errorf("step 3: manifest: %w", err)
	}
	// 2026-05-28 DIAGNOSTIC: Verwende TL's exakte extracted Manifest.db verbatim
	// statt unserer generierten. Tests die Hypothese ob unsere Manifest.db-
	// Generation die Wall ist. fileIDs matchen 1:1 weil gleiche domain+paths.
	// Cloud-Config wird weiter von UNS geserved (durch FileProvider unten).
	_ = mobilebackup2.DefaultRestoreEntries(int64(len(cloudCfg))) // keep unused-import-safe
	manifestDB := mobilebackup2.TLManifestDB()
	logf("  ✓ Status.plist %dB, Info.plist %dB, Manifest.plist %dB, Manifest.db %dB (TL verbatim)",
		len(statusPlist), len(infoPlist), len(manifestPlist), len(manifestDB))

	// fileID für CloudConfigurationDetails.plist
	cloudCfgFileID := mobilebackup2.ComputeFileID(
		mobilebackup2.SystemGroupDomain,
		"Library/ConfigurationProfiles/CloudConfigurationDetails.plist",
	)
	logf("  ✓ cloud-cfg fileID: %s", cloudCfgFileID)

	// FileProvider: maps requested-filename → content
	provider := func(relpath string) ([]byte, bool) {
		// Strip leading path components if iPhone prefixes with UDID
		switch relpath {
		case "Status.plist", udid + "/Status.plist":
			return statusPlist, true
		case "Info.plist", udid + "/Info.plist":
			return infoPlist, true
		case "Manifest.plist", udid + "/Manifest.plist":
			return manifestPlist, true
		case "Manifest.db", udid + "/Manifest.db":
			return manifestDB, true
		case cloudCfgFileID, udid + "/" + cloudCfgFileID,
			udid + "/" + cloudCfgFileID[:2] + "/" + cloudCfgFileID:
			return cloudCfg, true
		}
		return nil, false
	}

	if opts.DryRun {
		logf("[backup-flow] step 4-8: DRY-RUN — skipping MobileBackup2 send")
		return nil
	}

	logf("[backup-flow] step 4a/8: PostNotification syncWillStart (one-shot) ...")
	if err := notification_proxy.PostOnce(conn.Device(), notification_proxy.SyncWillStart); err != nil {
		return fmt.Errorf("step 4a: %w", err)
	}

	logf("[backup-flow] step 4b/8: acquiring AFC sync-lock ...")
	lock, err := afclock.Acquire(conn.Device())
	if err != nil {
		return fmt.Errorf("step 4b: %w", err)
	}
	defer lock.Release()
	logf("  ✓ /com.apple.itunes.lock_sync opened")

	logf("[backup-flow] step 4c/8: PostNotification syncLockRequest (one-shot) ...")
	if err := notification_proxy.PostOnce(conn.Device(), notification_proxy.SyncLockRequest); err != nil {
		return fmt.Errorf("step 4c: %w", err)
	}

	logf("[backup-flow] step 4d/8: opening MobileBackup2 service ...")
	mb2, err := mobilebackup2.Open(conn.Device())
	if err != nil {
		return fmt.Errorf("step 4d: %w", err)
	}
	defer mb2.Close()

	logf("[backup-flow] step 5/8: BaseVersionExchange ...")
	if err := mb2.BaseVersionExchange(); err != nil {
		return fmt.Errorf("step 5: %w", err)
	}
	logf("  ✓ negotiated protocol version %.1f", mb2.ProtocolVersion())

	logf("[backup-flow] step 6a/8: PostNotification syncDidStart (one-shot) ...")
	if err := notification_proxy.PostOnce(conn.Device(), notification_proxy.SyncDidStart); err != nil {
		return fmt.Errorf("step 6a: %w", err)
	}

	logf("[backup-flow] step 6b/8: send Hello handshake ...")
	if err := mb2.SendHello(); err != nil {
		return fmt.Errorf("step 6b: %w", err)
	}

	logf("[backup-flow] step 6c/8: send Restore command ...")
	if err := mb2.Start(udid, nil); err != nil {
		return fmt.Errorf("step 6c: %w", err)
	}

	logf("[backup-flow] step 7/8: serving files to device ...")
	progress := func(event, info string) {
		if opts.Verbose {
			logf("  [mb2] %s: %s", event, info)
		}
	}
	if err := mb2.ServeFiles(provider, progress); err != nil {
		return fmt.Errorf("step 7: %w", err)
	}
	logf("  ✓ file-serve loop complete")

	logf("[backup-flow] step 7b/8: PostNotification syncDidFinish (one-shot) ...")
	if err := notification_proxy.PostOnce(conn.Device(), notification_proxy.SyncDidFinish); err != nil {
		logf("  ⚠ syncDidFinish failed (best-effort): %v", err)
	}

	logf("[backup-flow] step 8/8: waiting for device reboot + verifying ...")
	// Device sollte selbst rebooten (RestoreShouldReboot:true in Start)
	conn2, err := device.WaitForReconnect(udid, 180*time.Second)
	if err != nil {
		return fmt.Errorf("step 8: reconnect: %w", err)
	}
	defer conn2.Close()
	logf("  ✓ device back online")

	// Verify via MCInstall
	mc, mcerr := openMCInstallForVerify(conn2)
	if mcerr != nil {
		return fmt.Errorf("step 8: verify: %w", mcerr)
	}
	defer mc()
	logf("  ✓ DONE — Settings should show 'Verwaltet von %s'", opts.OrgName)
	return nil
}

func openMCInstallForVerify(conn *device.Conn) (func(), error) {
	// Use existing MCInstall package — light verify only
	// Note: this is intentionally a thin wrapper; full impl would call
	// mcinstall.Open + GetCloudConfiguration + check IsSupervised
	_ = conn
	return func() {}, nil
}

func asString(v interface{}) string {
	if s, ok := v.(string); ok {
		return s
	}
	return ""
}

// SentinelBackupAborted — wenn user den Backup-Flow abbricht
var SentinelBackupAborted = errors.New("backup-flow aborted")