go-sip/internal/agent/recording_cleanup.go

package agent

import (
	"errors"
	"fmt"
	"log/slog"
	"os"
	"path/filepath"
	"strings"
)

type RecordingCleanupResult struct {
	DeletedFiles   int
	DeletedBytes   int64
	RetainedReason string
}

// cleanupDelivered requires the recording path lock. The original delivered
// info remains the completion proof until its audio deletion is durable.
func (r *RecordingRecovery) cleanupDelivered(entry RecordingRecoveryEntry) (result RecordingCleanupResult, cleanupErr error) {
	defer func() {
		attrs := append(recordingRecoveryAttrs(entry), "stage", "delivered_recording_cleanup", "deleted_files", result.DeletedFiles, "deleted_bytes", result.DeletedBytes)
		if cleanupErr != nil {
			slog.Error("Delivered recording cleanup failed; unfinished evidence retained", append(attrs, "error", cleanupErr)...)
		} else if result.RetainedReason != "" {
			slog.Info("Delivered recording retained", append(attrs, "reason", result.RetainedReason)...)
		} else {
			slog.Info("Delivered recording files cleaned", attrs...)
		}
	}()
	if entry.State != "delivered" || entry.Uploaded == nil {
		return result, errors.New("recording cleanup requires its persisted delivery receipt")
	}
	dir, audio, info, err := r.paths(entry.Bucket, entry.ObjectKey)
	if err != nil {
		return result, err
	}
	// Never follow a directory link or remove shared parents/unknown sidecars.
	current := r.Root
	for _, segment := range append([]string{"", entry.Bucket}, strings.Split(entry.ObjectKey, "/")...) {
		if segment != "" {
			current = filepath.Join(current, segment)
		}
		stat, err := os.Lstat(current)
		if err != nil {
			return result, err
		}
		if !stat.IsDir() || stat.Mode()&os.ModeSymlink != 0 || stat.Mode().Perm()&0077 != 0 {
			return result, errors.New("recording cleanup target is not an owned private directory")
		}
	}
	items, err := os.ReadDir(dir)
	if err != nil {
		return result, err
	}
	for _, item := range items {
		if item.Name() != "recording.wav" && item.Name() != "info.json" {
			return result, errors.New("recording cleanup target contains an unrecognized file")
		}
	}
	journal := ResultJournal{Root: r.Root}
	resultPath, err := journal.path(entry.SourceEventID)
	if err != nil {
		return result, err
	}
	release, err := holdPrivateState(resultPath)
	if err != nil {
		return result, err
	}
	defer release()
	pending, _, err := journal.load(entry.SourceEventID)
	if err == nil {
		if entry.DispatcherID != "" && (pending.DispatcherID != entry.DispatcherID || pending.TenantID != entry.TenantID) {
			return result, errors.New("original result reference conflicts with delivered recording ownership")
		}
		result.RetainedReason = "uncompleted_original_result_reference"
		return result, nil
	}
	if !errors.Is(err, os.ErrNotExist) {
		return result, fmt.Errorf("inspect original recording result reference: %w", err)
	}
	// Only this already-confirmed deletion path accepts an absent owned file.
	remove := func(path string) error {
		stat, err := os.Lstat(path)
		if errors.Is(err, os.ErrNotExist) {
			return nil
		}
		if err != nil {
			return err
		}
		if !stat.Mode().IsRegular() || stat.Mode().Perm()&0077 != 0 {
			return errors.New("recording cleanup file is not an owned private regular file")
		}
		if r.removeFile != nil {
			err = r.removeFile(path)
		} else {
			err = os.Remove(path)
		}
		if err != nil && !errors.Is(err, os.ErrNotExist) {
			return err
		}
		if err == nil {
			result.DeletedFiles++
			result.DeletedBytes += stat.Size()
		}
		return nil
	}
	// Validate the completion proof's file before removing either member.
	stat, err := os.Lstat(info)
	if err != nil || !stat.Mode().IsRegular() || stat.Mode().Perm()&0077 != 0 {
		return result, errors.Join(errors.New("recording delivery proof is not a private regular file"), err)
	}
	if err := remove(audio); err != nil {
		return result, fmt.Errorf("delete delivered recording audio: %w", err)
	}
	if err := syncDirectory(dir); err != nil {
		return result, fmt.Errorf("persist delivered audio deletion: %w", err)
	}
	filesBeforeInfo, bytesBeforeInfo := result.DeletedFiles, result.DeletedBytes
	restoreProof := func() error {
		err := r.persistState(info, entry)
		if err == nil {
			result.DeletedFiles, result.DeletedBytes = filesBeforeInfo, bytesBeforeInfo
		}
		return err
	}
	if err := remove(info); err != nil {
		return result, fmt.Errorf("delete delivered recording info: %w", err)
	}
	if err := syncDirectory(dir); err != nil {
		return result, errors.Join(fmt.Errorf("persist delivered info deletion: %w", err), restoreProof())
	}
	if r.removeFile != nil {
		err = r.removeFile(dir)
	} else {
		err = os.Remove(dir)
	}
	if err != nil && !errors.Is(err, os.ErrNotExist) {
		// The audio is gone, but a restored delivered receipt lets the next
		// recovery pass retry this exact leaf without replaying PUT/report.
		return result, errors.Join(fmt.Errorf("remove completed recording leaf: %w", err), restoreProof())
	}
	if err := syncDirectory(filepath.Dir(dir)); err != nil {
		return result, fmt.Errorf("persist recording leaf deletion: %w", err)
	}
	return result, nil
}