rz-archive 0.15.0

use camino::{Utf8Path, Utf8PathBuf};
use clap::{Parser, Subcommand, ValueEnum};
use clap_complete::Shell;

/// Password source flags (mutually exclusive).
///
/// Use `--password-stdin` to read from stdin (recommended — not visible in
/// process list or shell history).  `--password-file` reads the first line of
/// a file.  `--password` accepts an inline value that IS visible to other
/// processes via `ps` and is recorded in shell history — use with caution.
#[derive(Debug, clap::Args, Clone, Default)]
pub struct PasswordArgs {
    /// Read password from stdin (recommended — not visible in process list)
    #[arg(long, conflicts_with_all = ["password_file", "password"])]
    pub password_stdin: bool,

    /// Read password from a file (first line, whitespace-trimmed)
    #[arg(long, value_name = "PATH", conflicts_with_all = ["password_stdin", "password"])]
    pub password_file: Option<Utf8PathBuf>,

    /// Inline password (UNSAFE — visible in process list and shell history)
    #[arg(long, value_name = "STRING", conflicts_with_all = ["password_stdin", "password_file"])]
    pub password: Option<String>,
}

#[derive(Debug, Parser)]
#[command(
    name = "rz",
    version,
    about = "Multi-format compression and decompression tool"
)]
pub struct Cli {
    #[command(subcommand)]
    pub command: Command,

    /// Show a progress bar
    #[arg(short, long, global = true, conflicts_with = "quiet")]
    pub progress: bool,

    /// Print each entry name to stderr as it is processed
    #[arg(short, long, global = true, conflicts_with = "quiet")]
    pub verbose: bool,

    /// Suppress all non-error output
    #[arg(short, long, global = true)]
    pub quiet: bool,

    /// Worker thread count for parallel operations (gzip/zstd compression,
    /// zip decompression). 0 = auto-detect (default).
    #[arg(long, value_name = "N", global = true)]
    pub threads: Option<usize>,
}

#[derive(Debug, Subcommand)]
pub enum Command {
    /// Compress files or directories
    #[command(alias = "c")]
    Compress {
        /// Input path(s)
        #[arg(required_unless_present = "files_from")]
        input: Vec<Utf8PathBuf>,

        /// Output file (inferred if omitted)
        #[arg(short, long)]
        output: Option<Utf8PathBuf>,

        /// Format (inferred from output extension if omitted)
        #[arg(short, long)]
        format: Option<Format>,

        /// Compression level (format-dependent)
        #[arg(short, long, conflicts_with = "store")]
        level: Option<u32>,

        /// Store without compression (equivalent to --level 0)
        #[arg(short = '0', long)]
        store: bool,

        /// Exclude files matching a glob pattern (repeatable)
        #[arg(long)]
        exclude: Vec<String>,

        /// Read exclude patterns from a file (one per line)
        #[arg(long)]
        exclude_from: Vec<Utf8PathBuf>,

        /// Read input file list from a file (one path per line)
        #[arg(short = 'T', long)]
        files_from: Option<Utf8PathBuf>,

        /// Exclude version-control directories (.git, .hg, .svn, etc.)
        #[arg(long)]
        exclude_vcs: bool,

        /// Exclude backup files (*~, *.bak, #*#, .#*)
        #[arg(long)]
        exclude_backups: bool,

        /// Follow symlinks (archive target content instead of the link)
        #[arg(short = 'H', long)]
        follow_symlinks: bool,

        /// Print total bytes processed at the end
        #[arg(long)]
        totals: bool,

        /// Respect .gitignore rules when compressing
        #[arg(long)]
        exclude_vcs_ignores: bool,

        /// Do not recurse into directories
        #[arg(long)]
        no_recursion: bool,

        /// Show what would be compressed without creating an archive
        #[arg(short = 'n', long)]
        dry_run: bool,

        /// Override mtime on all entries (unix timestamp, e.g. 0 for epoch)
        #[arg(long)]
        mtime: Option<u64>,

        /// Override owner UID on all entries (e.g. 0 for root)
        #[arg(long)]
        owner: Option<u64>,

        /// Override group GID on all entries (e.g. 0 for root)
        #[arg(long)]
        group: Option<u64>,

        /// Override permission mode on all entries (octal, e.g. 644)
        #[arg(long, value_parser = parse_octal_mode)]
        mode: Option<u32>,

        /// Include only entries with mtime strictly newer than DATE
        /// (RFC 3339, `YYYY-MM-DD`, or `@<unix-seconds>`; tar-family only)
        #[arg(long, value_name = "DATE", value_parser = parse_date)]
        newer_than: Option<i64>,

        /// Include only entries with mtime strictly older than DATE (tar-family only)
        #[arg(long, value_name = "DATE", value_parser = parse_date)]
        older_than: Option<i64>,

        /// Warn and skip inputs that fail to read instead of aborting
        /// (matches GNU tar's `--ignore-failed-read`).  An empty result
        /// after skipping still errors — we never write an empty archive.
        #[arg(long)]
        ignore_failed_read: bool,

        /// Password source for encrypted archives (zip and 7z only)
        #[command(flatten)]
        password_args: PasswordArgs,
    },

    /// Decompress an archive
    ///
    /// Reads from stdin when INPUT is omitted or `-` (format auto-detected from
    /// the stream; pass `--format` to override). zip and 7z need seekable input
    /// and cannot be read from stdin.
    #[command(alias = "d")]
    Decompress {
        /// Input archive (omit or use `-` to read from stdin)
        input: Option<Utf8PathBuf>,

        /// Output directory (default: current dir)
        #[arg(short, long)]
        output: Option<Utf8PathBuf>,

        /// Extract into a sub-directory derived from the archive name
        /// (e.g. `foo.tar.gz` extracts into `foo/`).  Created automatically.
        #[arg(short = 't', long, conflicts_with_all = ["output", "to_stdout", "no_directory"])]
        one_top_level: bool,

        /// Format (inferred from extension/magic bytes if omitted)
        #[arg(short, long)]
        format: Option<Format>,

        /// Overwrite existing files
        #[arg(short = 'F', long, conflicts_with_all = ["no_overwrite", "keep_newer"])]
        force: bool,

        /// Skip existing files silently instead of erroring
        #[arg(long, conflicts_with = "keep_newer")]
        no_overwrite: bool,

        /// Only extract entries newer than existing files on disk
        #[arg(short = 'u', long)]
        keep_newer: bool,

        /// Flatten directory structure (extract all files into output dir)
        #[arg(short = 'j', long)]
        no_directory: bool,

        /// Write extracted file contents to stdout instead of disk
        #[arg(short = 'O', long, conflicts_with = "output")]
        to_stdout: bool,

        /// Strip N leading path components during extraction
        #[arg(long, default_value_t = 0)]
        strip_components: u32,

        /// Exclude entries matching a glob pattern (repeatable)
        #[arg(long)]
        exclude: Vec<String>,

        /// Read exclude patterns from a file (one per line)
        #[arg(long)]
        exclude_from: Vec<Utf8PathBuf>,

        /// Include only entries matching a glob pattern (repeatable)
        #[arg(long)]
        include: Vec<String>,

        /// Print total bytes processed at the end
        #[arg(long)]
        totals: bool,

        /// Rename existing files instead of overwriting (appends .bak by default)
        #[arg(long, conflicts_with_all = ["force", "no_overwrite", "keep_newer"])]
        backup: bool,

        /// Suffix for backup files (implies --backup, default: .bak)
        #[arg(long, conflicts_with_all = ["force", "no_overwrite", "keep_newer"])]
        suffix: Option<String>,

        /// Restore original file permissions from archive metadata
        #[arg(short = 'P', long)]
        preserve_permissions: bool,

        /// Restore original owner/group (Unix + root only)
        #[arg(long, visible_alias = "numeric-owner")]
        same_owner: bool,

        /// Extract only entries with mtime strictly newer than DATE
        /// (RFC 3339, `YYYY-MM-DD`, or `@<unix-seconds>`)
        #[arg(long, value_name = "DATE", value_parser = parse_date)]
        newer_than: Option<i64>,

        /// Extract only entries with mtime strictly older than DATE
        #[arg(long, value_name = "DATE", value_parser = parse_date)]
        older_than: Option<i64>,

        /// Show what would be extracted without writing to disk
        #[arg(short = 'n', long)]
        dry_run: bool,

        /// Substring rewrite on extracted paths: --rename OLD=NEW (repeatable).
        /// Replaces all occurrences of OLD with NEW in each entry path.
        #[arg(long, value_name = "OLD=NEW", value_parser = parse_rename)]
        rename: Vec<(String, String)>,

        /// Prepend a path prefix to every extracted entry
        #[arg(long, value_name = "PATH", value_parser = parse_prefix)]
        prefix: Option<Utf8PathBuf>,

        /// Extract only these specific paths from the archive
        paths: Vec<String>,

        /// Password source for encrypted archives (zip and 7z only)
        #[command(flatten)]
        password_args: PasswordArgs,
    },

    /// List archive contents
    ///
    /// Reads from stdin when INPUT is omitted or `-` (format auto-detected from
    /// the stream; pass `--format` to override). zip and 7z need seekable input
    /// and cannot be read from stdin.
    #[command(alias = "ls")]
    List {
        /// Input archive (omit or use `-` to read from stdin)
        input: Option<Utf8PathBuf>,

        #[arg(short, long)]
        format: Option<Format>,

        /// Show detailed info (size, date, permissions)
        #[arg(short, long)]
        long: bool,

        /// Exclude entries matching a glob pattern (repeatable)
        #[arg(long)]
        exclude: Vec<String>,

        /// Read exclude patterns from a file (one per line)
        #[arg(long)]
        exclude_from: Vec<Utf8PathBuf>,

        /// Sort entries by field
        #[arg(long)]
        sort: Option<SortField>,

        /// Show sizes in human-readable format (KB, MB, GB)
        #[arg(long)]
        human_readable: bool,

        /// Output as JSON
        #[arg(long)]
        json: bool,

        /// Password source for encrypted archives (zip and 7z only)
        #[command(flatten)]
        password_args: PasswordArgs,
    },

    /// Test archive integrity (fully decompress without writing to disk)
    ///
    /// Reads from stdin when INPUT is omitted or `-` (format auto-detected from
    /// the stream; pass `--format` to override). zip and 7z need seekable input
    /// and cannot be read from stdin.
    #[command(alias = "t")]
    Test {
        /// Input archive (omit or use `-` to read from stdin)
        input: Option<Utf8PathBuf>,

        #[arg(short, long)]
        format: Option<Format>,

        /// Password source for encrypted archives (zip and 7z only)
        #[command(flatten)]
        password_args: PasswordArgs,
    },

    /// Show archive metadata
    ///
    /// Reads from stdin when INPUT is omitted or `-`. The format is
    /// auto-detected from the stream's magic bytes; pass `--format` to override
    /// (required only for streams that can't be sniffed). zip and 7z need
    /// seekable input and cannot be read from stdin.
    Info {
        /// Input archive (omit or use `-` to read from stdin)
        input: Option<Utf8PathBuf>,

        #[arg(short, long)]
        format: Option<Format>,

        /// Show sizes in human-readable format (KB, MB, GB)
        #[arg(long)]
        human_readable: bool,

        /// Output as JSON
        #[arg(long)]
        json: bool,

        /// Password source for encrypted archives (zip and 7z only)
        #[command(flatten)]
        password_args: PasswordArgs,
    },

    /// List supported archive formats
    Formats {
        /// Output as JSON
        #[arg(long)]
        json: bool,
    },

    /// Generate shell completions
    Completions {
        /// Target shell
        shell: Shell,
    },

    /// Generate a man page
    Man,

    /// Append files to an existing archive (tar -r, zip -u)
    ///
    /// Uncompressed tar and zip support in-place append (fast).  Compressed
    /// tar formats (tar.gz, tar.zst, tar.xz, tar.bz2) are rewritten to a new
    /// file under the same path, since their compression layer cannot be
    /// patched in place.  7z is not supported.
    #[command(alias = "r")]
    Append {
        /// Existing archive
        archive: Utf8PathBuf,

        /// Files or directories to add
        #[arg(required = true)]
        input: Vec<Utf8PathBuf>,

        /// Format (inferred from archive extension if omitted)
        #[arg(short, long)]
        format: Option<Format>,

        /// Compression level for the rewritten compressed-tar archive
        #[arg(short, long)]
        level: Option<u32>,

        /// Exclude files matching a glob pattern (repeatable)
        #[arg(long)]
        exclude: Vec<String>,

        /// Read exclude patterns from a file (one per line)
        #[arg(long)]
        exclude_from: Vec<Utf8PathBuf>,

        /// Follow symlinks (archive target content instead of the link)
        #[arg(short = 'H', long)]
        follow_symlinks: bool,
    },

    /// Append files only if newer than the matching entry in the archive
    /// (tar -u, zip -u).  Same format support and rewrite semantics as
    /// `append`.
    #[command(alias = "u")]
    Update {
        /// Existing archive
        archive: Utf8PathBuf,

        /// Files or directories to add (only entries newer than the archive
        /// copy are written)
        #[arg(required = true)]
        input: Vec<Utf8PathBuf>,

        /// Format (inferred from archive extension if omitted)
        #[arg(short, long)]
        format: Option<Format>,

        /// Compression level for the rewritten compressed-tar archive
        #[arg(short, long)]
        level: Option<u32>,

        /// Exclude files matching a glob pattern (repeatable)
        #[arg(long)]
        exclude: Vec<String>,

        /// Read exclude patterns from a file (one per line)
        #[arg(long)]
        exclude_from: Vec<Utf8PathBuf>,

        /// Follow symlinks (archive target content instead of the link)
        #[arg(short = 'H', long)]
        follow_symlinks: bool,
    },

    /// Convert an archive from one format to another
    ///
    /// Extracts to a temporary directory and re-compresses in the target
    /// format.  All format combinations are supported (tar-family ↔ zip ↔ 7z).
    #[command(alias = "cv")]
    Convert {
        /// Input archive
        input: Utf8PathBuf,

        /// Output archive path (extension used to infer format when --to is omitted)
        #[arg(short, long)]
        output: Option<Utf8PathBuf>,

        /// Input format (inferred from extension/magic bytes if omitted)
        #[arg(long)]
        from: Option<Format>,

        /// Output format (inferred from --output extension if omitted)
        #[arg(long)]
        to: Option<Format>,

        /// Compression level for the output archive
        #[arg(short, long)]
        level: Option<u32>,

        /// Overwrite existing output file
        #[arg(short = 'F', long)]
        force: bool,
    },

    /// Remove entries from an archive (tar --delete, zip -d)
    ///
    /// Always implemented as a read-then-rewrite into a new file under the
    /// same path.  7z is not supported.
    #[command(alias = "rm")]
    Remove {
        /// Existing archive
        archive: Utf8PathBuf,

        /// Glob patterns of entries to remove
        #[arg(required = true)]
        patterns: Vec<String>,

        /// Format (inferred from archive extension if omitted)
        #[arg(short, long)]
        format: Option<Format>,

        /// Compression level for the rewritten compressed-tar archive
        #[arg(short, long)]
        level: Option<u32>,
    },
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
pub enum Format {
    Zip,
    /// tar (no compression)
    Tar,
    /// tar + gzip
    #[value(alias = "tar.gz", alias = "tgz")]
    TarGz,
    /// tar + zstd
    #[value(alias = "tar.zst", alias = "tzst")]
    TarZst,
    /// tar + xz
    #[value(alias = "tar.xz", alias = "txz")]
    TarXz,
    /// tar + bzip2
    #[value(alias = "tar.bz2", alias = "tbz2")]
    TarBz2,
    /// 7z — the id every other 7z tool uses; "seven-z" (the derived
    /// kebab-case name) stays as an alias for anything scripted against it
    #[value(name = "7z", alias = "seven-z")]
    SevenZ,
}

#[derive(Debug, Clone, PartialEq, Eq, ValueEnum)]
pub enum SortField {
    Name,
    Size,
    Date,
}

/// Parse a user-supplied date spec into a Unix timestamp (seconds since epoch).
///
/// Accepts three spellings, in order of preference:
///   * `@<unix>` — literal seconds since the epoch, e.g. `@1700000000`
///   * RFC 3339, e.g. `2024-01-02T03:04:05Z` or `2024-01-02T03:04:05+02:00`
///   * Date-only `YYYY-MM-DD`, interpreted as midnight UTC
///
/// The result is i64-sign-extended so callers can express pre-1970 dates, but
/// in practice every tar header stores a u64-ish mtime, so negatives get
/// clamped later.
pub fn parse_date(s: &str) -> std::result::Result<i64, String> {
    if let Some(rest) = s.strip_prefix('@') {
        return rest
            .parse::<i64>()
            .map_err(|e| format!("invalid unix timestamp `{s}`: {e}"));
    }

    // Try full RFC 3339 first — covers offsets and `Z`.
    if let Ok(dt) = time::OffsetDateTime::parse(s, &time::format_description::well_known::Rfc3339) {
        return Ok(dt.unix_timestamp());
    }

    // Fall back to date-only (midnight UTC).
    let date_fmt = time::macros::format_description!("[year]-[month]-[day]");
    if let Ok(date) = time::Date::parse(s, date_fmt) {
        let dt = date.with_hms(0, 0, 0).map_err(|e| e.to_string())?;
        return Ok(dt.assume_utc().unix_timestamp());
    }

    Err(format!(
        "invalid date `{s}` (expected RFC 3339 like \
         `2024-01-02T03:04:05Z`, a date `2024-01-02`, or `@<unix-seconds>`)"
    ))
}

/// Parse an octal permission mode.  Accepts `"644"`, `"0644"`, and `"0o644"`.
/// Rejects values with set bits outside the low 12 bits (setuid/setgid/sticky
/// plus the standard rwx triads).
fn parse_octal_mode(s: &str) -> std::result::Result<u32, String> {
    let stripped = s
        .strip_prefix("0o")
        .or_else(|| s.strip_prefix("0O"))
        .unwrap_or(s);
    let mode =
        u32::from_str_radix(stripped, 8).map_err(|e| format!("invalid octal mode `{s}`: {e}"))?;
    if mode & !0o7777 != 0 {
        return Err(format!(
            "mode `{s}` has bits outside the 12-bit permission range (max 7777)"
        ));
    }
    Ok(mode)
}

/// Parse a `--rename OLD=NEW` argument into a `(old, new)` pair.
/// Rejects empty OLD strings.
pub fn parse_rename(s: &str) -> std::result::Result<(String, String), String> {
    let (old, new) = s
        .split_once('=')
        .ok_or_else(|| format!("invalid --rename `{s}` (expected OLD=NEW)"))?;
    if old.is_empty() {
        return Err(format!("--rename `{s}`: OLD must not be empty"));
    }
    Ok((old.to_owned(), new.to_owned()))
}

/// Validate that a prefix does not escape the extraction root.
/// Called at CLI parse time so the error appears before any I/O.
pub fn parse_prefix(s: &str) -> std::result::Result<Utf8PathBuf, String> {
    // Reuse the same safety check as safe_entry_path (no `..`, no absolute).
    for component in Utf8Path::new(s).components() {
        if matches!(component, camino::Utf8Component::ParentDir) {
            return Err(format!("--prefix `{s}` contains `..` components"));
        }
    }
    if Utf8Path::new(s).is_absolute() {
        return Err(format!("--prefix `{s}` must be a relative path"));
    }
    Ok(Utf8PathBuf::from(s))
}

#[cfg(test)]
mod tests {
    use super::*;

    type TestResult = std::result::Result<(), Box<dyn std::error::Error>>;

    #[test]
    fn threads_flag_parses() -> TestResult {
        let cli = Cli::try_parse_from(["rz", "--threads", "4", "compress", "."])?;
        assert_eq!(cli.threads, Some(4));
        Ok(())
    }

    #[test]
    fn threads_zero_parses() -> TestResult {
        let cli = Cli::try_parse_from(["rz", "--threads", "0", "compress", "."])?;
        assert_eq!(cli.threads, Some(0));
        Ok(())
    }

    #[test]
    fn threads_absent_is_none() -> TestResult {
        let cli = Cli::try_parse_from(["rz", "compress", "."])?;
        assert_eq!(cli.threads, None);
        Ok(())
    }

    #[test]
    fn threads_after_subcommand_parses() -> TestResult {
        let cli = Cli::try_parse_from(["rz", "compress", "--threads", "2", "."])?;
        assert_eq!(cli.threads, Some(2));
        Ok(())
    }

    #[test]
    fn to_stdout_conflicts_with_output() {
        let res = Cli::try_parse_from(["rz", "decompress", "a.tar", "-O", "-o", "outdir"]);
        assert!(
            res.is_err(),
            "-O silently ignoring -o hid the fact that outdir stays empty"
        );
    }

    #[test]
    fn prefix_rejects_parent_traversal_at_parse_time() {
        let res = Cli::try_parse_from(["rz", "decompress", "a.tar", "--prefix", "../escape"]);
        assert!(
            res.is_err(),
            "--prefix with `..` must be rejected during parsing"
        );
    }

    #[test]
    fn prefix_rejects_absolute_at_parse_time() {
        let res = Cli::try_parse_from(["rz", "decompress", "a.tar", "--prefix", "/abs"]);
        assert!(
            res.is_err(),
            "an absolute --prefix must be rejected during parsing"
        );
    }

    #[test]
    fn prefix_accepts_relative() -> TestResult {
        let cli = Cli::try_parse_from(["rz", "decompress", "a.tar", "--prefix", "restore/v2"])?;
        if let Command::Decompress { prefix, .. } = cli.command {
            assert_eq!(prefix, Some(Utf8PathBuf::from("restore/v2")));
        } else {
            return Err("expected Decompress subcommand".into());
        }
        Ok(())
    }
}