#!/bin/bash
# yt-dlp-session RUN-ID [YT-DLP OPTIONS AND URLS...]: written by Wren Linux
# extras/yt-dlp.sh, installed as /usr/local/libexec/yt-dlp-session, owned by
# root. It runs as the user ytdlp (your user may run this, and nothing else, as
# ytdlp: /etc/sudoers.d/wren-ytdlp). The yt-dlp command (bin/yt-dlp) starts
# it with a new RUN-ID each time.
#
# yt-dlp runs in a folder of its own for this run, $OUT/RUN-ID, which only
# ytdlp and your group can open; the yt-dlp command copies what it downloaded
# from there into your ~/Downloads afterwards. yt-dlp itself is root's file:
# ytdlp can run it but not change it. YouTube's JavaScript runs in Debian's
# QuickJS (qjs), as ytdlp too. Config files are ignored, so a run can't leave
# settings behind for the next one; give options on the command line.
set -eu

YTDLP=/usr/local/lib/wren/yt-dlp/yt-dlp
OUT=/var/lib/wren-ytdlp-out
HOME_DIR=/var/lib/wren-ytdlp

id=${1:-}
[[ $id =~ ^[0-9a-f]{24}$ ]] || { echo "yt-dlp-session: start it with the yt-dlp command" >&2; exit 2; }
shift

export HOME=$HOME_DIR XDG_CACHE_HOME=$HOME_DIR/.cache PATH=/usr/bin:/bin
# The firewall that keeps it off your computer and network, seen from this user:
# no rule, no download (bin/sandbox-net-check); and while it runs, it is watched
netcheck=/usr/local/libexec/wren-sandbox-net-check
[ -x "$netcheck" ] || { echo "yt-dlp-session: $netcheck is missing. Run: wrenctl install yt-dlp" >&2; exit 1; }
"$netcheck" || { echo "yt-dlp-session: the firewall that keeps it off your network isn't active, so nothing was downloaded. Run: sudo systemctl restart wren-ytdlp-firewall" >&2; exit 1; }
# (exec keeps this process's number, so the watch follows yt-dlp itself)
"$netcheck" --watch $$ </dev/null >/dev/null 2>&1 &
# Files and folders it makes: rw for ytdlp and your group (the folder's), so
# you can copy them out and delete them; nothing for anyone else
umask 0007
# A new folder each run (it fails if one with that id is there already). A
# plain mkdir: it inherits the setgid bit and your group from $OUT, so what
# yt-dlp makes in it gets your group and you can read it. (mkdir -m, or any
# chmod, would lose the setgid bit: Linux clears it when a user who isn't in
# the folder's group, as ytdlp isn't in yours, sets the mode.)
mkdir "$OUT/$id"
cd "$OUT/$id"
# It runs site JavaScript: without a way to reach XWayland's abstract socket
noabs=/usr/local/libexec/wren-no-abstract-sockets
[ -x "$noabs" ] || { echo "yt-dlp-session: $noabs is missing. Run: wrenctl install yt-dlp" >&2; exit 1; }
# python3 -I: no Python settings from the environment, no packages of ytdlp's own
exec "$noabs" python3 -I "$YTDLP" --ignore-config --no-update --js-runtimes quickjs "$@"