#!/usr/bin/python3

import os
import re
import sys

RESTRICTED_DIR = "/srv/www/app"
SAFE_ARGUMENT = re.compile(r"^[A-Za-z0-9_.,=+:/@%*~-]+$")


def fail(message: str) -> None:
    print(f"rsync-deploy: {message}", file=sys.stderr)
    raise SystemExit(64)


remote_args = sys.argv[1:]

if os.geteuid() != 0:
    fail("must run through sudo")

if not remote_args or remote_args[0] != "--server":
    fail("receiver mode is required")

if any(not SAFE_ARGUMENT.fullmatch(arg) for arg in remote_args):
    fail("unsupported remote argument")

os.environ["SSH_ORIGINAL_COMMAND"] = "rsync " + " ".join(remote_args)
os.execv(
    "/usr/bin/rrsync",
    ["rrsync", "-wo", "-no-del", "-munge", RESTRICTED_DIR],
)