-- Binary-safe XOR encryption/decryption
local function xorCipherBinary(data, key)
    if type(data) ~= "string" then
        error("Data must be a string. Type found: " .. type(data))
    end
    local result = {}
    local keyLength = #key
    for i = 1, #data do
        local keyChar = key:byte((i - 1) % keyLength + 1)
        result[i] = string.char(bit.bxor(data:byte(i), keyChar))
    end
    return table.concat(result)
end

-- Encrypt a file (binary-safe)
local function encryptFile(path, key)
    local file = fs.open(path, "rb")
    if not file then
        error("Failed to open file for reading: " .. path)
    end
    local data = file.readAll()
    file.close()

    if not data then
        error("Failed to read data from file: " .. path)
    end

    print("Read " .. #data .. " bytes from file.")

    local encryptedData = xorCipherBinary(data, key)
    local encryptedFile = fs.open(path, "wb")
    if encryptedFile then
        encryptedFile.write(encryptedData)
        encryptedFile.close()
        print("Encrypted: " .. path)
    else
        error("Failed to open file for writing: " .. path)
    end
end

-- Decrypt a file (binary-safe)
local function decryptFile(path, key)
    local file = fs.open(path, "rb")
    if not file then
        error("Failed to open file for reading: " .. path)
    end
    local encryptedData = file.readAll()
    file.close()

    if not encryptedData then
        error("Failed to read data from file: " .. path)
    end

    print("Read " .. #encryptedData .. " bytes from file.")

    local decryptedData = xorCipherBinary(encryptedData, key)
    local decryptedFile = fs.open(path, "wb")
    if decryptedFile then
        decryptedFile.write(decryptedData)
        decryptedFile.close()
        print("Decrypted: " .. path)
    else
        error("Failed to open file for writing: " .. path)
    end
end

-- Custom hash function (for password)
local function customHash(data)
    local hash = 0
    for i = 1, #data do
        hash = bit.bxor(hash, data:byte(i) * i)
        hash = (hash * 31) % 2^32 -- Keep hash within 32-bit range
    end
    return tostring(hash)
end

-- Generate random key
local function generateRandomKey(length)
    local key = {}
    for i = 1, length do
        table.insert(key, string.char(math.random(0, 255)))
    end
    return table.concat(key)
end

-- Save encrypted key to .syskey
local function saveKeyFile(passphrase, randomKey)
    local hashFile = "/.syskey"
    local hashedPassphrase = customHash(passphrase)
    local encryptedKey = xorCipherBinary(randomKey, hashedPassphrase)

    local file = fs.open(hashFile, "w")
    if file then
        file.write(encryptedKey)
        file.close()
        print("Credentials and key saved to /.syskey.")
    else
        error("Failed to save key to /.syskey.")
    end
end

-- Load the encrypted key from .syskey
local function loadKeyFile(passphrase)
    local hashFile = "/.syskey"
    if not fs.exists(hashFile) then
        error("Credentials file not found. Please set a passphrase first.")
    end

    local file = fs.open(hashFile, "r")
    local encryptedKey = file.readAll()
    file.close()

    -- Decrypt the key using the passphrase
    return xorCipherBinary(encryptedKey, customHash(passphrase))
end

-- Process directory (encrypt or decrypt)
local function processDirectory(dir, key, operation)
    local items = fs.list(dir)
    local failedFiles = {}

    for _, item in ipairs(items) do
        local fullPath = fs.combine(dir, item)
        if fs.isDir(fullPath) then
            processDirectory(fullPath, key, operation)
        else
            local success, err = pcall(function()
                if operation == "encrypt" then
                    encryptFile(fullPath, key)
                elseif operation == "decrypt" then
                    decryptFile(fullPath, key)
                end
            end)

            if not success then
                -- Log the file path and error message if encryption failed
                failedFiles[fullPath] = err
            end
        end
    end

    -- After processing, retry files that failed
    if #failedFiles > 0 then
        print("\nRetrying files that failed to encrypt:")
        for path, errorMsg in pairs(failedFiles) do
            print("Failed to encrypt: " .. path .. " - " .. errorMsg)
            print("Retrying...")
            local success, err = pcall(function()
                if operation == "encrypt" then
                    encryptFile(path, key)
                elseif operation == "decrypt" then
                    decryptFile(path, key)
                end
            end)
            if not success then
                print("Still failed: " .. path .. " - " .. err)
            else
                print("Successfully retried: " .. path)
            end
        end
    end
end

-- Main script
local args = { ... }
if #args < 1 then
    print("Usage:")
    print("  Set passphrase: encrypt_disk set <passphrase>")
    print("  Encrypt disk:   encrypt_disk encrypt")
    print("  Decrypt disk:   encrypt_disk decrypt <passphrase>")
    return
end

local command = args[1]:lower()

if command == "set" then
    if #args < 2 then
        error("Usage: encrypt_disk set <passphrase>")
    end
    local passphrase = args[2]
    local randomKey = generateRandomKey(64)  -- Generate a random key of length 64 bytes
    print("Encrypting all files in /disk...")
    processDirectory("/disk", randomKey, "encrypt")
    saveKeyFile(passphrase, randomKey)
    print("Encryption complete.")

elseif command == "encrypt" then
    if #args < 2 then
        error("Usage: encrypt_disk encrypt <passphrase>")
    end
    local passphrase = args[2]
    local key = loadKeyFile(passphrase) -- Load the encrypted key from file
    print("Encrypting all files in /disk using the key...")
    processDirectory("/disk", key, "encrypt")
    print("Encryption complete.")

elseif command == "decrypt" then
    if #args < 2 then
        error("Usage: encrypt_disk decrypt <passphrase>")
    end
    local passphrase = args[2]
    local key = loadKeyFile(passphrase) -- Load the encrypted key from file
    print("Decrypting all files in /disk...")
    processDirectory("/disk", key, "decrypt")
    print("Decryption complete.")
else
    print("Unknown command: " .. command)
    print("Valid commands: set, encrypt, decrypt")
end