#!/bin/bash
# /usr/local/lib/opsec/opsec-lib.sh — Shared OPSEC function library
# Sourced by all OPSEC scripts for config management and common operations

OPSEC_CONF="/etc/opsec/opsec.conf"
OPSEC_COUNTRY_CODES="/etc/opsec/country-codes.conf"
OPSEC_PROFILES_DIR="/etc/opsec/profiles"
OPSEC_STATE_FILE="/var/run/opsec-advanced.enabled"
OPSEC_BOOT_MARKER="/etc/opsec/boot-advanced.enabled"

# ─── COLOR OUTPUT ──────────────────────────────────────────────────────────────
opsec_green()  { echo -e "\033[38;5;49m[+]\033[0m \033[38;5;49m$*\033[0m"; }
opsec_red()    { echo -e "\033[38;5;196m[-]\033[0m \033[38;5;196m$*\033[0m"; }
opsec_yellow() { echo -e "\033[38;5;214m[*]\033[0m \033[38;5;214m$*\033[0m"; }
opsec_info()   { echo -e "\033[38;5;39m[~]\033[0m \033[38;5;75m$*\033[0m"; }
opsec_cyan()   { echo -e "\033[38;5;51m[>]\033[0m \033[38;5;51m$*\033[0m"; }
opsec_mag()    { echo -e "\033[38;5;201m[*]\033[0m \033[38;5;201m$*\033[0m"; }
opsec_dim()    { echo -e "\033[38;5;244m    $*\033[0m"; }
opsec_hdr()    { echo -e "\033[38;5;51m━━━ \033[38;5;201m$*\033[38;5;51m ━━━\033[0m"; }

# ─── CONFIG MANAGEMENT ─────────────────────────────────────────────────────────

opsec_load_config() {
    if [ -f "$OPSEC_CONF" ]; then
        # shellcheck disable=SC1090
        . "$OPSEC_CONF"
        return 0
    fi
    return 1
}

opsec_save_config() {
    # Re-serialize all known keys back to config file
    # Preserves comments and structure
    local tmp
    tmp=$(mktemp)
    cat > "$tmp" << 'HEADER'
# /etc/opsec/opsec.conf — Central OPSEC Configuration
# Shell-sourceable KEY="value" format. All scripts source this file.
# Edit via: sudo opsec-config.sh (interactive TUI)

HEADER

    cat >> "$tmp" << EOF
# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
PROFILE_NAME="${PROFILE_NAME:-default}"

# ─── TOR SETTINGS ──────────────────────────────────────────────────────────────
TOR_CIRCUIT_ROTATION="${TOR_CIRCUIT_ROTATION:-30}"
TOR_BLACKLIST="${TOR_BLACKLIST:-}"
TOR_STRICT_NODES="${TOR_STRICT_NODES:-1}"
TOR_ISOLATION="${TOR_ISOLATION:-1}"
TOR_PADDING="${TOR_PADDING:-1}"
TOR_SOCKS_PORT="${TOR_SOCKS_PORT:-9050}"
TOR_DNS_PORT="${TOR_DNS_PORT:-5353}"
TOR_TRANS_PORT="${TOR_TRANS_PORT:-9040}"
TOR_NUM_GUARDS="${TOR_NUM_GUARDS:-3}"
TOR_SAFE_LOGGING="${TOR_SAFE_LOGGING:-1}"

# ─── DNS SETTINGS ──────────────────────────────────────────────────────────────
DNS_MODE="${DNS_MODE:-tor}"
DNS_CUSTOM_SERVERS="${DNS_CUSTOM_SERVERS:-}"

# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
KILLSWITCH_ALLOW_DHCP="${KILLSWITCH_ALLOW_DHCP:-1}"
KILLSWITCH_ALLOW_OPENVPN="${KILLSWITCH_ALLOW_OPENVPN:-1}"
KILLSWITCH_ALLOW_WIREGUARD="${KILLSWITCH_ALLOW_WIREGUARD:-1}"
KILLSWITCH_EXTRA_PORTS="${KILLSWITCH_EXTRA_PORTS:-}"

# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
MAC_INTERFACES="${MAC_INTERFACES:-auto}"
MAC_VENDOR_SPOOF="${MAC_VENDOR_SPOOF:-}"

# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
HOSTNAME_PATTERN="${HOSTNAME_PATTERN:-desktop}"
HOSTNAME_CUSTOM_PREFIX="${HOSTNAME_CUSTOM_PREFIX:-}"

# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
HARDEN_IPV6="${HARDEN_IPV6:-1}"
HARDEN_SWAP="${HARDEN_SWAP:-1}"
HARDEN_CORE_DUMPS="${HARDEN_CORE_DUMPS:-1}"
HARDEN_CLIPBOARD_CLEAR="${HARDEN_CLIPBOARD_CLEAR:-0}"
HARDEN_SCREEN_LOCK="${HARDEN_SCREEN_LOCK:-1}"
HARDEN_SCREEN_LOCK_TIMEOUT="${HARDEN_SCREEN_LOCK_TIMEOUT:-300}"
HARDEN_TIMEZONE_SPOOF="${HARDEN_TIMEZONE_SPOOF:-0}"
HARDEN_TIMEZONE_VALUE="${HARDEN_TIMEZONE_VALUE:-UTC}"
HARDEN_LOCALE_SPOOF="${HARDEN_LOCALE_SPOOF:-0}"
HARDEN_LOCALE_VALUE="${HARDEN_LOCALE_VALUE:-en_US.UTF-8}"

# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
LEAK_WEBRTC_BLOCK="${LEAK_WEBRTC_BLOCK:-1}"
LEAK_USB_BLOCK="${LEAK_USB_BLOCK:-0}"

# ─── MONITORING ────────────────────────────────────────────────────────────────
MONITOR_PROCESSES="${MONITOR_PROCESSES:-0}"
MONITOR_LOG_ROTATION="${MONITOR_LOG_ROTATION:-1}"
LOG_ROTATION_HOURS="${LOG_ROTATION_HOURS:-4}"

# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
TRAFFIC_JITTER_ENABLED="${TRAFFIC_JITTER_ENABLED:-0}"
TRAFFIC_JITTER_MS="${TRAFFIC_JITTER_MS:-50}"

# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
LEVEL_TYPE="${LEVEL_TYPE:-standard}"

# ─── BASE STATE ───────────────────────────────────────────────────────────────
BASE_DNS="${BASE_DNS:-quad9}"
BASE_MAC_RANDOMIZE="${BASE_MAC_RANDOMIZE:-1}"
BASE_IPV6_DISABLE="${BASE_IPV6_DISABLE:-1}"

# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
TOR_BRIDGE_MODE="${TOR_BRIDGE_MODE:-off}"
TOR_BRIDGE_RELAY="${TOR_BRIDGE_RELAY:-}"

# ─── SECURE DELETION ──────────────────────────────────────────────────────────
WIPE_METHOD="${WIPE_METHOD:-auto}"

# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
DEPLOYMENT_LEVEL="${DEPLOYMENT_LEVEL:-bare-metal-standard}"

# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
OPSEC_BANNER="${OPSEC_BANNER:-compact}"

# ─── WIDGET THEME ────────────────────────────────────────────────────────────
WIDGET_THEME="${WIDGET_THEME:-default}"
EOF
    mv "$tmp" "$OPSEC_CONF"
    chmod 600 "$OPSEC_CONF"
}

opsec_set_value() {
    local key="$1" val="$2"
    if [ -z "$key" ]; then return 1; fi
    # Validate key: must be a valid shell variable name (letters, digits, underscore, starts with letter/underscore)
    if ! echo "$key" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
        echo "[!] opsec_set_value: invalid key name '${key}'" >&2
        return 1
    fi
    # Sanitize value: strip characters that could break shell quoting
    val=$(printf '%s' "$val" | tr -d '`$\\\"'"'" | tr -cd '[:print:]')
    opsec_load_config
    eval "${key}=\"${val}\""
    opsec_save_config
}

opsec_get_value() {
    local key="$1"
    # Validate key: must be a valid shell variable name
    if ! echo "$key" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
        echo "[!] opsec_get_value: invalid key name '${key}'" >&2
        return 1
    fi
    opsec_load_config
    eval "echo \"\${${key}:-}\""
}

# ─── TORRC GENERATION ──────────────────────────────────────────────────────────

opsec_generate_torrc() {
    local _dbg="/run/opsec/debug.log"
    echo "[$(date -Is)] [lib] opsec_generate_torrc called" >> "$_dbg" 2>/dev/null || true

    opsec_load_config || return 1

    local torrc="/etc/tor/torrc"
    local socks_port="${TOR_SOCKS_PORT:-9050}"
    local trans_port="${TOR_TRANS_PORT:-9040}"
    local dns_port="${TOR_DNS_PORT:-5353}"
    local rotation="${TOR_CIRCUIT_ROTATION:-30}"
    local blacklist="${TOR_BLACKLIST:-}"
    local strict="${TOR_STRICT_NODES:-1}"
    local isolation="${TOR_ISOLATION:-1}"
    local padding="${TOR_PADDING:-1}"
    local guards="${TOR_NUM_GUARDS:-3}"
    local safe_log="${TOR_SAFE_LOGGING:-1}"
    echo "[$(date -Is)] [lib]   socks=${socks_port} trans=${trans_port} dns=${dns_port} blacklist=${blacklist}" >> "$_dbg" 2>/dev/null || true

    # Build SocksPort line with isolation flags
    local socks_line="SocksPort ${socks_port}"
    if [ "$isolation" = "1" ]; then
        socks_line="${socks_line} IsolateDestAddr IsolateDestPort"
    fi

    # Build ExcludeExitNodes from blacklist
    local exclude_line=""
    if [ -n "$blacklist" ]; then
        local formatted
        formatted=$(echo "$blacklist" | sed 's/\([a-z][a-z]\)/{\1}/g; s/,/,/g')
        exclude_line="ExcludeExitNodes ${formatted}"
    fi

    local bridge_mode="${TOR_BRIDGE_MODE:-off}"
    local bridge_relay="${TOR_BRIDGE_RELAY:-}"

    cat > "$torrc" << EOF
# Autogenerated — do not edit manually
# Regenerate via: opsec-config.sh --apply

# ─── SOCKS, TRANSPARENT PROXY & DNS ─────────────────────────────────────────
${socks_line}
TransPort ${trans_port}
DNSPort ${dns_port}

# ─── EXIT NODE EXCLUSION ────────────────────────────────────────────────────
${exclude_line}
StrictNodes ${strict}

# ─── CIRCUIT ROTATION ───────────────────────────────────────────────────────
MaxCircuitDirtiness ${rotation}

# ─── TRAFFIC PADDING ────────────────────────────────────────────────────────
ConnectionPadding ${padding}

# ─── SAFE LOGGING ────────────────────────────────────────────────────────────
SafeLogging ${safe_log}
Log notice file /run/tor/notices.log

# ─── ENTRY GUARDS ───────────────────────────────────────────────────────────
NumEntryGuards ${guards}
UseEntryGuards 1

EOF

    # ─── PLUGGABLE TRANSPORTS (bridges) ──────────────────────────────────────
    if [ "$bridge_mode" != "off" ] && [ "$bridge_mode" != "" ]; then
        cat >> "$torrc" << 'BRIDGE_HEADER'

# ─── BRIDGE CONFIGURATION ────────────────────────────────────────────────────
UseBridges 1
BRIDGE_HEADER

        case "$bridge_mode" in
            obfs4)
                echo "ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy" >> "$torrc"
                ;;
            meek-azure)
                echo "ClientTransportPlugin meek_lite exec /usr/bin/obfs4proxy" >> "$torrc"
                ;;
            snowflake)
                # snowflake-client location varies by distro
                local sf_bin
                sf_bin=$(command -v snowflake-client 2>/dev/null || echo "/usr/bin/snowflake-client")
                echo "ClientTransportPlugin snowflake exec ${sf_bin}" >> "$torrc"
                ;;
        esac

        # Add user-specified bridge relay if provided
        if [ -n "$bridge_relay" ]; then
            echo "Bridge ${bridge_relay}" >> "$torrc"
        else
            # Default bridges for each transport type
            case "$bridge_mode" in
                meek-azure)
                    echo "Bridge meek_lite 192.0.2.18:80 BE776A53492E1E044A26F17306E1BC46A55A1625 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com" >> "$torrc"
                    ;;
                snowflake)
                    echo "Bridge snowflake 192.0.2.3:80 2B280B23E1107BB62ABFC40DDCC8824814F80A72 fingerprint=2B280B23E1107BB62ABFC40DDCC8824814F80A72 url=https://snowflake-broker.torproject.net.global.prod.fastly.net/ front=foursquare.com ice=stun:stun.l.google.com:19302,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 utls-imitate=hellorandomizedalpn" >> "$torrc"
                    ;;
            esac
        fi
    fi

    chmod 644 "$torrc"
    echo "[$(date -Is)] [lib]   torrc written ($(wc -l < "$torrc") lines)" >> "$_dbg" 2>/dev/null || true
    echo "[$(date -Is)] [lib]   torrc contents:" >> "$_dbg" 2>/dev/null || true
    cat "$torrc" >> "$_dbg" 2>/dev/null || true
    echo "[$(date -Is)] [lib]   --- end torrc ---" >> "$_dbg" 2>/dev/null || true
}

# ─── RESOLV.CONF GENERATION ───────────────────────────────────────────────────

opsec_generate_resolv() {
    local _dbg="/run/opsec/debug.log"
    echo "[$(date -Is)] [lib] opsec_generate_resolv called" >> "$_dbg" 2>/dev/null || true

    opsec_load_config || return 1

    local mode="${DNS_MODE:-tor}"
    local resolv="/etc/resolv.conf"
    echo "[$(date -Is)] [lib]   DNS_MODE=${mode}" >> "$_dbg" 2>/dev/null || true

    # Unlock if immutable
    chattr -i "$resolv" 2>/dev/null || true

    case "$mode" in
        tor)
            echo "nameserver 127.0.0.1" > "$resolv"
            ;;
        quad9)
            cat > "$resolv" << 'EOF'
nameserver 9.9.9.9
nameserver 149.112.112.112
EOF
            ;;
        cloudflare)
            cat > "$resolv" << 'EOF'
nameserver 1.1.1.1
nameserver 1.0.0.1
EOF
            ;;
        doh)
            # DNS-over-HTTPS via dnscrypt-proxy
            # Ensure dnscrypt-proxy is running
            if command -v dnscrypt-proxy >/dev/null 2>&1; then
                # Deploy config if not present
                if [ ! -f /etc/dnscrypt-proxy/dnscrypt-proxy.toml ] && [ -f /etc/opsec/dnscrypt-proxy.toml ]; then
                    mkdir -p /etc/dnscrypt-proxy
                    cp /etc/opsec/dnscrypt-proxy.toml /etc/dnscrypt-proxy/dnscrypt-proxy.toml
                fi
                mkdir -p /var/log/dnscrypt-proxy /var/cache/dnscrypt-proxy
                # Stop systemd-resolved if it conflicts on :53
                systemctl stop systemd-resolved 2>/dev/null || true
                systemctl start dnscrypt-proxy 2>/dev/null || dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml &
            fi
            cat > "$resolv" << 'EOF'
nameserver 127.0.0.53
EOF
            ;;
        dot)
            # DNS-over-TLS via systemd-resolved
            cat > "$resolv" << 'EOF'
nameserver 127.0.0.53
options edns0 trust-ad
EOF
            ;;
        custom)
            if [ -n "$DNS_CUSTOM_SERVERS" ]; then
                : > "$resolv"
                local IFS=','
                for server in $DNS_CUSTOM_SERVERS; do
                    echo "nameserver ${server}" >> "$resolv"
                done
            else
                echo "nameserver 9.9.9.9" > "$resolv"
            fi
            ;;
        *)
            echo "nameserver 9.9.9.9" > "$resolv"
            ;;
    esac

    # Lock if in advanced mode
    if opsec_is_advanced; then
        chattr +i "$resolv"
        echo "[$(date -Is)] [lib]   resolv.conf locked (chattr +i)" >> "$_dbg" 2>/dev/null || true
    fi
    echo "[$(date -Is)] [lib]   resolv.conf contents: $(cat "$resolv" 2>/dev/null | tr '\n' ' ')" >> "$_dbg" 2>/dev/null || true
}

# ─── STATE CHECKS ─────────────────────────────────────────────────────────────

opsec_is_advanced() {
    [ -f "$OPSEC_STATE_FILE" ]
}

opsec_is_boot_enabled() {
    [ -f "$OPSEC_BOOT_MARKER" ]
}

# ─── PROFILE MANAGEMENT ───────────────────────────────────────────────────────

opsec_profile_save() {
    local name="$1"
    if [ -z "$name" ]; then return 1; fi
    mkdir -p "$OPSEC_PROFILES_DIR"
    cp "$OPSEC_CONF" "${OPSEC_PROFILES_DIR}/${name}.conf"
    # Tag profile name inside the saved copy
    sed -i "s/^PROFILE_NAME=.*/PROFILE_NAME=\"${name}\"/" "${OPSEC_PROFILES_DIR}/${name}.conf"
}

opsec_profile_load() {
    local name="$1"
    local profile="${OPSEC_PROFILES_DIR}/${name}.conf"
    if [ ! -f "$profile" ]; then return 1; fi
    cp "$profile" "$OPSEC_CONF"
    # Update active profile name
    sed -i "s/^PROFILE_NAME=.*/PROFILE_NAME=\"${name}\"/" "$OPSEC_CONF"
}

opsec_profile_list() {
    if [ -d "$OPSEC_PROFILES_DIR" ]; then
        find "$OPSEC_PROFILES_DIR" -name '*.conf' -printf '%f\n' | sed 's/\.conf$//'
    fi
}

opsec_profile_delete() {
    local name="$1"
    rm -f "${OPSEC_PROFILES_DIR}/${name}.conf"
}

opsec_profile_export() {
    local name="$1" dest="$2"
    local profile="${OPSEC_PROFILES_DIR}/${name}.conf"
    if [ ! -f "$profile" ]; then return 1; fi
    cp "$profile" "$dest"
}

opsec_profile_import() {
    local src="$1" name="$2"
    if [ ! -f "$src" ]; then return 1; fi
    mkdir -p "$OPSEC_PROFILES_DIR"
    cp "$src" "${OPSEC_PROFILES_DIR}/${name}.conf"
}

# ─── COUNTRY CODE HELPERS ─────────────────────────────────────────────────────

opsec_load_country_presets() {
    if [ -f "$OPSEC_COUNTRY_CODES" ]; then
        # shellcheck disable=SC1090
        . "$OPSEC_COUNTRY_CODES"
    fi
}

opsec_get_preset() {
    local preset="$1"
    opsec_load_country_presets
    case "$preset" in
        5eyes|fiveeyes)   echo "$FIVE_EYES" ;;
        9eyes|nineeyes)   echo "$NINE_EYES" ;;
        14eyes|fourteeneyes) echo "$FOURTEEN_EYES" ;;
        surveillance)     echo "$SURVEILLANCE_STATES" ;;
        max)              echo "$MAX_EXCLUSION" ;;
        *)                echo "" ;;
    esac
}

# ─── DEPLOYMENT LEVEL MANAGEMENT ─────────────────────────────────────────────

OPSEC_LEVELS_DIR="/etc/opsec/levels"

opsec_level_list() {
    if [ -d "$OPSEC_LEVELS_DIR" ]; then
        find "$OPSEC_LEVELS_DIR" -name '*.conf' -printf '%f\n' | sed 's/\.conf$//' | sort
    fi
}

opsec_level_apply() {
    local level="$1"
    local level_file="${OPSEC_LEVELS_DIR}/${level}.conf"
    if [ ! -f "$level_file" ]; then
        opsec_red "Level '${level}' not found in ${OPSEC_LEVELS_DIR}"
        return 1
    fi

    # Preserve current PROFILE_NAME before overwriting
    opsec_load_config 2>/dev/null || true
    local saved_profile="${PROFILE_NAME:-default}"

    # Copy level preset over active config
    cp "$level_file" "$OPSEC_CONF"
    chmod 600 "$OPSEC_CONF"

    # Restore profile name and ensure deployment level is tagged
    opsec_load_config
    PROFILE_NAME="$saved_profile"
    DEPLOYMENT_LEVEL="$level"
    opsec_save_config
}

# ─── SECURE DELETION ─────────────────────────────────────────────────────────

opsec_detect_storage_type() {
    # Detect storage type for a given path
    # Returns: hdd | ssd | luks | unknown
    local target_path="${1:-/}"
    local device

    # Find the block device for the path
    device=$(df -P "$target_path" 2>/dev/null | tail -1 | awk '{print $1}')
    [ -z "$device" ] && echo "unknown" && return

    # Check for LUKS
    if command -v cryptsetup >/dev/null 2>&1; then
        # Check if device is on a dm-crypt layer
        local dm_name
        dm_name=$(basename "$device" 2>/dev/null)
        if [ -e "/sys/block/${dm_name}/dm/uuid" ] 2>/dev/null; then
            local dm_uuid
            dm_uuid=$(cat "/sys/block/${dm_name}/dm/uuid" 2>/dev/null)
            if echo "$dm_uuid" | grep -qi "CRYPT-LUKS"; then
                echo "luks"
                return
            fi
        fi
        # Also check via dmsetup
        if dmsetup info "$device" 2>/dev/null | grep -qi "CRYPT-LUKS"; then
            echo "luks"
            return
        fi
    fi

    # Resolve to physical disk (strip partition number, handle /dev/mapper)
    local phys_disk
    phys_disk=$(lsblk -ndo PKNAME "$device" 2>/dev/null | head -1)
    [ -z "$phys_disk" ] && phys_disk=$(echo "$device" | sed 's/[0-9]*$//' | sed 's|^/dev/||')

    # Check rotational flag (0 = SSD, 1 = HDD)
    local rotational_file="/sys/block/${phys_disk}/queue/rotational"
    if [ -f "$rotational_file" ]; then
        local rotational
        rotational=$(cat "$rotational_file" 2>/dev/null)
        if [ "$rotational" = "0" ]; then
            echo "ssd"
        else
            echo "hdd"
        fi
        return
    fi

    echo "unknown"
}

opsec_secure_delete() {
    # SSD-aware secure file deletion
    # Usage: opsec_secure_delete <file_or_dir> [method]
    # method: auto (default) | shred | fstrim | luks
    local target="$1"
    local method="${2:-${WIPE_METHOD:-auto}}"

    [ -z "$target" ] && return 1

    if [ "$method" = "auto" ]; then
        method=$(opsec_detect_storage_type "$target")
    fi

    case "$method" in
        hdd|shred)
            # Traditional shred for spinning disks
            if [ -d "$target" ]; then
                find "$target" -type f -exec shred -fuz -n 1 {} \; 2>/dev/null
                rm -rf "$target" 2>/dev/null
            elif [ -f "$target" ]; then
                shred -fuz -n 1 "$target" 2>/dev/null
            fi
            ;;
        ssd|fstrim)
            # For SSDs: overwrite with zeros, delete, then fstrim
            # shred is ineffective on SSDs due to wear leveling
            if [ -d "$target" ]; then
                find "$target" -type f -exec dd if=/dev/zero of={} bs=4k count=1 conv=notrunc 2>/dev/null \;
                find "$target" -type f -delete 2>/dev/null
                rm -rf "$target" 2>/dev/null
            elif [ -f "$target" ]; then
                dd if=/dev/zero of="$target" bs=4k count=1 conv=notrunc 2>/dev/null
                rm -f "$target" 2>/dev/null
            fi
            # Request TRIM/discard on the filesystem
            local mount_point
            mount_point=$(df -P "${target%/*}" 2>/dev/null | tail -1 | awk '{print $6}')
            if [ -n "$mount_point" ]; then
                fstrim "$mount_point" 2>/dev/null || true
            fi
            ;;
        luks)
            # For LUKS: zero file + rely on LUKS key destroy for full wipe
            if [ -d "$target" ]; then
                find "$target" -type f -exec dd if=/dev/zero of={} bs=4k count=1 conv=notrunc 2>/dev/null \;
                find "$target" -type f -delete 2>/dev/null
                rm -rf "$target" 2>/dev/null
            elif [ -f "$target" ]; then
                dd if=/dev/zero of="$target" bs=4k count=1 conv=notrunc 2>/dev/null
                rm -f "$target" 2>/dev/null
            fi
            # Note: full LUKS key destroy handled by emergency-wipe
            ;;
        *)
            # Fallback: basic shred
            if [ -d "$target" ]; then
                find "$target" -type f -exec shred -fuz -n 1 {} \; 2>/dev/null
                rm -rf "$target" 2>/dev/null
            elif [ -f "$target" ]; then
                shred -fuz -n 1 "$target" 2>/dev/null
            fi
            ;;
    esac
}

# ─── WIDGET THEME MANAGEMENT ─────────────────────────────────────────────────

OPSEC_THEMES_DIR="/etc/opsec/themes"

opsec_theme_list() {
    if [ -d "$OPSEC_THEMES_DIR" ]; then
        find "$OPSEC_THEMES_DIR" -name '*.theme' -printf '%f\n' | sed 's/\.theme$//' | sort
    fi
}

opsec_generate_conky() {
    opsec_load_config || return 1

    local theme="${WIDGET_THEME:-default}"
    local theme_file="${OPSEC_THEMES_DIR}/${theme}.theme"

    if [ ! -f "$theme_file" ]; then
        opsec_red "Theme '${theme}' not found at ${theme_file}"
        return 1
    fi

    # Source theme to get CONKY_COLOR* and CONKY_BG values
    # shellcheck disable=SC1090
    . "$theme_file"

    local conky_conf_name="conky-opsec-widget.conf"

    # Find and regenerate conky config for each user with the widget installed
    for home_dir in /home/*; do
        local conky_conf="${home_dir}/.config/conky/${conky_conf_name}"
        [ -f "$conky_conf" ] || continue

        local owner
        owner=$(stat -c '%U' "$conky_conf" 2>/dev/null) || continue

        cat > "$conky_conf" << CONKYEOF
-- OPSEC Status Widget
-- Colors managed by theme system via opsec-config.sh
-- Theme: ${theme} (${THEME_LABEL:-Custom})

conky.config = {
    -- Window settings
    alignment = 'top_right',
    gap_x = 15,
    gap_y = 60,
    minimum_width = 400,
    minimum_height = 200,
    maximum_width = 420,

    -- Multi-monitor: run xrandr --listmonitors to find head number
    xinerama_head = 0,

    -- Window type
    own_window = true,
    own_window_type = 'desktop',
    own_window_transparent = false,
    own_window_argb_visual = true,
    own_window_argb_value = 210,
    own_window_colour = '${CONKY_BG:-0d1117}',
    own_window_hints = 'undecorated,below,sticky,skip_taskbar,skip_pager',

    -- Drawing
    double_buffer = true,
    draw_shades = true,
    default_shade_color = '000000',
    draw_outline = false,
    draw_borders = true,
    border_inner_margin = 12,
    border_outer_margin = 4,
    border_width = 1,
    border_colour = '1b3a5c',
    stippled_borders = 0,

    -- Font
    use_xft = true,
    font = 'JetBrains Mono:size=10',
    override_utf8_locale = true,

    -- Colors — Theme: ${theme}
    default_color = 'b0b0b0',
    color0 = '${CONKY_COLOR0:-df2020}',
    color1 = '${CONKY_COLOR1:-33ff33}',
    color2 = '${CONKY_COLOR2:-3a8fd6}',
    color3 = '${CONKY_COLOR3:-0d1117}',
    color4 = '${CONKY_COLOR4:-1f6feb}',
    color5 = '${CONKY_COLOR5:-58a6ff}',
    color6 = '${CONKY_COLOR6:-79c0ff}',
    color7 = '${CONKY_COLOR7:-c9d1d9}',
    color8 = '${CONKY_COLOR8:-1f6feb}',
    color9 = '${CONKY_COLOR9:-484f58}',

    -- Update interval
    update_interval = 3,
    total_run_times = 0,

    -- Misc
    cpu_avg_samples = 2,
    no_buffers = true,
    text_buffer_size = 8192,
    short_units = true,
};

conky.text = [[
\${execpi 5 ~/.config/conky/conky-opsec-status.sh}
]];
CONKYEOF

        chown "$owner":"$owner" "$conky_conf"
        chmod 644 "$conky_conf"
    done

    # Restart conky for all users running the opsec widget
    pkill -f 'conky.*opsec' 2>/dev/null || true
    sleep 1

    for home_dir in /home/*; do
        local conky_conf="${home_dir}/.config/conky/${conky_conf_name}"
        [ -f "$conky_conf" ] || continue

        local owner
        owner=$(stat -c '%U' "$conky_conf" 2>/dev/null) || continue
        local uid
        uid=$(id -u "$owner" 2>/dev/null) || continue

        # Relaunch conky as the file owner
        su - "$owner" -c "DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus nohup conky -c '${conky_conf}' >/dev/null 2>&1 &" 2>/dev/null || true
    done
}

# ─── INIT CHECK ────────────────────────────────────────────────────────────────
# Ensure /etc/opsec exists
_opsec_init_dirs() {
    [ -d /etc/opsec ] || mkdir -p /etc/opsec
    [ -d "$OPSEC_PROFILES_DIR" ] || mkdir -p "$OPSEC_PROFILES_DIR"
}

# Auto-init on source if running as root
if [ "$EUID" = "0" ] 2>/dev/null || [ "$(id -u)" = "0" ] 2>/dev/null; then
    _opsec_init_dirs
fi