#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/lib/common.sh"

PROJECT_ENV=""
while [ "$#" -gt 0 ]; do
  case "$1" in
    --project-env) PROJECT_ENV="$2"; shift 2 ;;
    *) die "unknown argument: $1" ;;
  esac
done

[ -n "$PROJECT_ENV" ] || die "--project-env is required"
load_env_file "$PROJECT_ENV"
assert_no_placeholders "$PROJECT_ENV"
EXPECTED_OS_ID="$OS_ID"
EXPECTED_OS_VERSION_ID="$OS_VERSION_ID"
EXPECTED_KYLIN_RELEASE_ID="$KYLIN_RELEASE_ID"

FAILURES=0
WARNINGS=0
check() {
  local label="$1"
  shift
  if "$@"; then
    printf 'PASS\t%s\n' "$label"
  else
    printf 'FAIL\t%s\n' "$label"
    FAILURES=$((FAILURES + 1))
  fi
}
warn() {
  printf 'WARN\t%s\n' "$1"
  WARNINGS=$((WARNINGS + 1))
}
free_gib() {
  df -Pk "$1" | awk 'NR==2 {printf "%d", $4 / 1024 / 1024}'
}

check "architecture=${CPU_ARCH}" test "$(uname -m)" = "$CPU_ARCH"
check "os_release_present" test -f /etc/os-release
if [ -f /etc/os-release ]; then
  # shellcheck disable=SC1091
  source /etc/os-release
  check "os_id=${EXPECTED_OS_ID}" test "${ID:-}" = "$EXPECTED_OS_ID"
  check "os_version=${EXPECTED_OS_VERSION_ID}" test "${VERSION_ID:-}" = "$EXPECTED_OS_VERSION_ID"
  check "kylin_release=${EXPECTED_KYLIN_RELEASE_ID}" test "${KYLIN_RELEASE_ID:-}" = "$EXPECTED_KYLIN_RELEASE_ID"
fi
check "apt_available" command -v apt-get
check "data_root_mounted=${DATA_ROOT}" findmnt -n "$DATA_ROOT"
check "system_free_ge_${SYSTEM_MIN_FREE_GIB}GiB" test "$(free_gib /)" -ge "$SYSTEM_MIN_FREE_GIB"
check "data_free_ge_${DATA_MIN_FREE_GIB}GiB" test "$(free_gib "$DATA_ROOT")" -ge "$DATA_MIN_FREE_GIB"
check "login_user_exists=${DEPLOY_LOGIN_USER}" getent passwd "$DEPLOY_LOGIN_USER"
check "login_user_in_sudo_group" bash -c "id -nG '$DEPLOY_LOGIN_USER' | tr ' ' '\n' | grep -qx sudo"

if [ "$(id -u)" -eq 0 ]; then
  USER_SSH_EFFECTIVE="$(sshd -T -C "user=${DEPLOY_LOGIN_USER},host=$(hostname),addr=127.0.0.1")"
  ROOT_SSH_EFFECTIVE="$(sshd -T -C "user=root,host=$(hostname),addr=127.0.0.1")"
  check "user_password_auth_enabled" grep -qx 'passwordauthentication yes' <<<"$USER_SSH_EFFECTIVE"
  check "root_password_auth_disabled" grep -Eq '^permitrootlogin (no|prohibit-password|without-password)$' <<<"$ROOT_SSH_EFFECTIVE"
else
  warn "run as root after sudo -i to verify effective SSH policy"
fi

check "mqtt_dns" getent hosts "$ALIYUN_MQTT_ENDPOINT"
check "mqtt_tcp_ipv4_${ALIYUN_MQTT_PORT}" network_tcp_check_ipv4 "$ALIYUN_MQTT_ENDPOINT" "$ALIYUN_MQTT_PORT"
check "baidu_https_ipv4" curl -4 -sS --connect-timeout 5 --max-time 10 -o /dev/null "$BAIDU_FACE_API_BASE/"
check "oss_https_ipv4" curl -4 -sS --connect-timeout 5 --max-time 10 -o /dev/null "$ALIYUN_OSS_PUBLIC_HOST"

for command_name in nginx php mysql redis-server supervisord; do
  if command -v "$command_name" >/dev/null 2>&1; then
    warn "existing runtime command detected: $command_name"
  fi
done
if command -v docker >/dev/null 2>&1; then
  warn "Docker is installed but explicitly out of scope; do not stop, remove or reuse it"
fi

if [ "${ALLOW_EOL_RUNTIME:-false}" = "true" ]; then
  printf 'PASS\teol_runtime_exception_confirmed\n'
else
  printf 'FAIL\teol_runtime_exception_missing_for_mysql56_php73_php74\n'
  FAILURES=$((FAILURES + 1))
fi

printf 'WARN_COUNT=%s\n' "$WARNINGS"
printf 'FAIL_COUNT=%s\n' "$FAILURES"
[ "$FAILURES" -eq 0 ]