audit echo vs log across all scripts — outcomes always visible, verbose for per-item loops

2026-06-14 12:40:15 -04:00
parent 4c37ab16fd
commit 3964f6fb46
1010 changed files with 377767 additions and 132 deletions
@@ -0,0 +1,229 @@
+#!/bin/bash
+# ==============================================================================================
+# ============================= Bulk Permissions Repair ========================================
+# ==============================================================================================
+#
+# PURPOSE
+# ─────────────────────────────────────────────────────────────────────────────
+# Applies correct ownership and permissions to one or more specific paths.
+# Targeted repair — faster than media_shares_permissions.sh, which processes
+# every configured share. Use after failed transfers that left root:root ownership,
+# containers writing as root before PUID/PGID was fixed, manual file copies, or
+# new shares that need permissions applied before the next nightly run.
+#
+# Counts files with wrong ownership before fixing. A high count on a recently
+# written share means a container has wrong PUID/PGID — add PUID=99 PGID=100
+# to its Docker template. Common culprits: SABnzbd, qBittorrent, slskd.
+#
+# ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Permissions Model
+#   Directories (PERMISSIONS_DIR_MODE, default 755):
+#     Owner (nobody) — rwx  enter, list, create files
+#     Group (users)  — r-x  enter and list
+#     Others         — r-x  Samba guests can browse
+#   Files (PERMISSIONS_FILE_MODE, default 664):
+#     Owner (nobody) — rw   read + write
+#     Group (users)  — rw   arrs can import and rename
+#     Others         — r    Samba guests can read
+#     No execute bit — media files are never executable
+#
+# Separate Passes
+#   Directories and files are chmod'd in separate find passes. A combined pass
+#   with mode 664 would wrongly strip the execute bit from directories, making
+#   them untraversable.
+#
+# ==============================================================================================
+# OPERATIONAL SAFEGUARDS
+# ==============================================================================================
+#
+# Root Required
+#   chown requires root — exits immediately if not running as root.
+#
+# Path Existence Check
+#   Each path is verified before processing — missing paths log an error and
+#   are skipped rather than silently passing.
+#
+# Notification Validated
+#   platform_require_cmd confirms the notify script is present before use.
+#
+# Silent on Success
+#   Only failures and the wrong-owner diagnostic produce visible output.
+#
+# ==============================================================================================
+# CONFIGURATION
+# ==============================================================================================
+#
+# master.conf
+#
+#   PERMISSIONS_OWNER
+#       Owner applied to all paths. (default: nobody:users)
+#
+#   PERMISSIONS_DIR_MODE
+#       chmod mode for directories. (default: 755)
+#
+#   PERMISSIONS_FILE_MODE
+#       chmod mode for files. (default: 664)
+#
+# ==============================================================================================
+# RUNTIME MODES
+# ==============================================================================================
+#
+# bulk_permissions_repair.sh /path/to/share [/another/path ...]
+#     Apply ownership and permissions to each specified path.
+#
+# bulk_permissions_repair.sh /path/to/share --dry-run
+#     Show wrong-owner count per path. No chown or chmod applied.
+#
+# bulk_permissions_repair.sh /path/to/share --log
+#     Verbose output including per-path file counts and modes applied.
+#
+# ==============================================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+source "$SCRIPT_DIR/../load_config.sh"
+
+parse_args "$@"
+
+# ==============================================================================================
+# ━━━ Setup ━━━
+# ==============================================================================================
+if [[ "$EUID" -ne 0 ]]; then
+    error "Must be run as root — chown requires root"
+    exit 1
+fi
+
+acquire_lock
+
+
+# detect_hosts() sets MY_ID — used in summary
+detect_hosts
+
+if [[ ${#PARSED_ARGS[@]} -eq 0 ]]; then
+    error "No paths specified"
+    error "Usage: bulk_permissions_repair.sh /path/to/share [/another/path] [--dry-run]"
+    exit 1
+fi
+
+log "Dir mode:  ${PERMISSIONS_DIR_MODE:-755}"
+log "File mode: ${PERMISSIONS_FILE_MODE:-664}"
+log "Owner:     $PERMISSIONS_OWNER"
+[[ "$DRY_RUN" == true ]] && warn "DRY RUN — no permissions will be changed"
+
+# ==============================================================================================
+# ━━━ Apply Permissions ━━━
+# ==============================================================================================
+echo ""
+echo "━━━ $ICON_PERMS Permissions Repair — $MY_ID ━━━"
+
+START=$(date +%s)
+PASS=()
+FAIL=()
+TOTAL_WRONG_OWNER=0
+
+for share_path in "${PARSED_ARGS[@]}"; do
+    [[ -z "$share_path" ]] && continue
+
+    echo ""
+    echo "━━━ $ICON_PERMS $(basename "$share_path") ━━━"
+
+    if [[ ! -d "$share_path" ]]; then
+        error "$share_path — not found"
+        FAIL+=("$share_path")
+        continue
+    fi
+
+    # Count files for context — warn level so user knows what they're in for on large shares
+    FILE_COUNT=$(find "$share_path" -type f 2>/dev/null | wc -l)
+    DIR_COUNT=$(find  "$share_path" -type d 2>/dev/null | wc -l)
+    SIZE=$(du -sh "$share_path" 2>/dev/null | cut -f1)
+    warn "$share_path — $FILE_COUNT files, $DIR_COUNT dirs ($SIZE)"
+
+    # Count files with wrong ownership before fixing — diagnostic
+    WRONG_OWNER=$(find "$share_path" \( ! -user nobody -o ! -group users \) \
+        2>/dev/null | wc -l)
+    if [[ "$WRONG_OWNER" -gt 0 ]]; then
+        warn "$WRONG_OWNER file(s) with wrong ownership — fixing..."
+        if [[ "$WRONG_OWNER" -gt 500 ]]; then
+            warn "High wrong-owner count — check container PUID/PGID settings (should be PUID=99 PGID=100)"
+            warn "Common culprits: SABnzbd, qBittorrent, slskd"
+        fi
+        TOTAL_WRONG_OWNER=$(( TOTAL_WRONG_OWNER + WRONG_OWNER ))
+    else
+        log "Ownership already correct — applying mode only"
+    fi
+
+    if [[ "$DRY_RUN" == true ]]; then
+        warn "DRY RUN — would apply:"
+        warn "  chown -R $PERMISSIONS_OWNER $share_path"
+        warn "  find -type d → chmod ${PERMISSIONS_DIR_MODE:-755}"
+        warn "  find -type f → chmod ${PERMISSIONS_FILE_MODE:-664}"
+        PASS+=("$(basename "$share_path")")
+        continue
+    fi
+
+    CHOWN_OK=true
+    CHMOD_DIR_OK=true
+    CHMOD_FILE_OK=true
+
+    # Apply ownership first
+    log "Applying ownership: $PERMISSIONS_OWNER..."
+    chown -R "$PERMISSIONS_OWNER" "$share_path" 2>/dev/null || CHOWN_OK=false
+
+    # Apply directory permissions — separate pass (dirs need execute bit)
+    log "Applying directory permissions: ${PERMISSIONS_DIR_MODE:-755}..."
+    find "$share_path" -type d \
+        -exec chmod "${PERMISSIONS_DIR_MODE:-755}" {} + 2>/dev/null || CHMOD_DIR_OK=false
+
+    # Apply file permissions — no execute bit on media files
+    log "Applying file permissions: ${PERMISSIONS_FILE_MODE:-664}..."
+    find "$share_path" -type f \
+        -exec chmod "${PERMISSIONS_FILE_MODE:-664}" {} + 2>/dev/null || CHMOD_FILE_OK=false
+
+    if [[ "$CHOWN_OK" == true && "$CHMOD_DIR_OK" == true && "$CHMOD_FILE_OK" == true ]]; then
+        log "$ICON_UNLOCKED $(basename "$share_path") — permissions applied ✅"
+        PASS+=("$(basename "$share_path")")
+    else
+        error "$(basename "$share_path") — repair failed"
+        error "  chown: $CHOWN_OK  chmod dirs: $CHMOD_DIR_OK  chmod files: $CHMOD_FILE_OK"
+        FAIL+=("$(basename "$share_path")")
+    fi
+done
+
+END=$(date +%s)
+
+# ==============================================================================================
+# ━━━ Summary ━━━
+# ==============================================================================================
+echo ""
+echo "━━━━━ $ICON_SUMMARY PERMISSIONS REPAIR SUMMARY ━━━━━"
+echo "$ICON_HOST    Identity:  $MY_ID ($LOCAL_SERVER_NAME)"
+echo "$ICON_PERMS   Dir mode:  ${PERMISSIONS_DIR_MODE:-755}"
+echo "$ICON_PERMS   File mode: ${PERMISSIONS_FILE_MODE:-664}"
+echo "$ICON_PERMS   Owner:     $PERMISSIONS_OWNER"
+echo "$ICON_TIME    Duration:  $(format_duration $(( END - START )))"
+echo ""
+[[ ${#PASS[@]} -gt 0 ]] && log "Pass: ${PASS[*]}"
+[[ ${#FAIL[@]} -gt 0 ]] && echo "$ICON_ERROR Fail: ${FAIL[*]}"
+
+if [[ "$TOTAL_WRONG_OWNER" -gt 0 ]]; then
+    warn "Total wrong-owner files fixed: $TOTAL_WRONG_OWNER"
+fi
+echo ""
+
+if [[ "$DRY_RUN" == true ]]; then
+    warn "DRY RUN — no changes made"
+elif [[ ${#FAIL[@]} -gt 0 ]]; then
+    echo "$ICON_ERROR Status: SOME REPAIRS FAILED"
+    notify "Permissions repair failed on $(hostname) — ${FAIL[*]}" \
+        "Permissions Repair" "warning"
+else
+    echo "$ICON_DONE Status: done — ${#PASS[@]} path(s) repaired"
+fi
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+[[ ${#FAIL[@]} -gt 0 ]] && exit 1
+exit 0