#!/usr/bin/env bash
set -Eeuo pipefail
UPLOAD_ROOT="/var/lib/rustypaste/uploads"
QUARANTINE="/var/lib/rustypaste-quarantine"
LOG_FILE="/var/log/rustypaste-scan/scan.log"
FILE="${1:-}"
log(){ printf '%s %s\n' "$(date --iso-8601=seconds)" "$*" >> "$LOG_FILE"; logger -t rustypaste-clamav -- "$*"; }
[[ -n "$FILE" ]] || { log "ERROR no file supplied"; exit 2; }
RESOLVED="$(realpath -e -- "$FILE" 2>/dev/null || true)"
[[ -n "$RESOLVED" ]] || exit 0
ROOT="$(realpath -e -- "$UPLOAD_ROOT")"
case "$RESOLVED" in "$ROOT"/*) ;; *) log "REFUSED outside upload root: $RESOLVED"; exit 2;; esac
[[ -f "$RESOLVED" ]] || exit 0
PREVIOUS=-1
for _ in {1..30}; do CURRENT="$(stat -c '%s' -- "$RESOLVED" 2>/dev/null || echo -1)"; [[ "$CURRENT" -eq "$PREVIOUS" ]] && break; PREVIOUS="$CURRENT"; sleep 1; done
set +e
OUTPUT="$(clamdscan --fdpass --no-summary -- "$RESOLVED" 2>&1)"
RESULT=$?
set -e
case "$RESULT" in
  0) log "CLEAN file=$RESOLVED size=$(stat -c '%s' -- "$RESOLVED")";;
  1) DEST="$QUARANTINE/$(date +%Y%m%dT%H%M%S)-$(basename -- "$RESOLVED")"; mv -- "$RESOLVED" "$DEST"; chmod 0600 "$DEST"; log "INFECTED original=$RESOLVED quarantine=$DEST result=$OUTPUT";;
  *) log "SCAN_ERROR file=$RESOLVED exit=$RESULT result=$OUTPUT"; exit "$RESULT";;
esac
