#!/bin/bash
set -euo pipefail

cdx_phase="${1-}"
if [[ "$cdx_phase" != '--preflight' && "$cdx_phase" != '--apply' && "$cdx_phase" != '--rollback' ]]; then
    printf 'DENIED: exact phase required\n' >&2
    exit 78
fi
cdx_source=/Users/wiscourper/Documents/workspace/zhct/zhctproject/ai_api/app/common/database/DmBuilder.php
cdx_remote_root=/tmp/zhct-dm-poc-20260928.fcpiiN/ai_api
cdx_remote_file="$cdx_remote_root/app/common/database/DmBuilder.php"
cdx_socket=/tmp/cdx-dm-account.pEx2Py/control
cdx_new_sha=b8afe5f37fe7ee6307fcfc1e902bd0bcac246f7153c1dfb56fc5883c3e510f24
cdx_old_sha=9ece7684e98997d45183375b1d5baaca42e4aac788b1cf4d073a0ebf5752aa35
[[ -f "$cdx_source" ]]
[[ "$(shasum -a 256 "$cdx_source" | awk '{print $1}')" == "$cdx_new_sha" ]]
ssh -S "$cdx_socket" -o BatchMode=yes -O check root@121.43.241.161 >/dev/null

if [[ "$cdx_phase" == '--preflight' ]]; then
    ssh -S "$cdx_socket" -o BatchMode=yes root@121.43.241.161 \
        'set -e; [[ "$(readlink -f /proc/53772/exe)" == "/www/server/php/74/bin/php" ]]; [[ "$(readlink -f /tmp/zhct-ai-http-20260929.3XDj3w/vendor)" == "/tmp/zhct-dm-poc-20260928.fcpiiN/ai_api/vendor" ]]; sha256sum /tmp/zhct-dm-poc-20260928.fcpiiN/ai_api/app/common/database/DmBuilder.php; /www/server/php/74/bin/php -l /tmp/zhct-dm-poc-20260928.fcpiiN/ai_api/app/common/database/DmBuilder.php'
    printf 'C_BUILDER_READONLY_PREFLIGHT local_new_sha=%s expected_old_sha=%s business_http=0 business_dml=0\n' \
        "$cdx_new_sha" "$cdx_old_sha"
    exit 0
fi

cdx_self_sha="$(shasum -a 256 "$0" | awk '{print $1}')"
if [[ "${CDX_AI_BUILDER_REVIEWED_SHA256-}" != "$cdx_self_sha" ]]; then
    printf 'DENIED: reviewed script SHA required\n' >&2
    exit 78
fi
if [[ "$cdx_phase" == '--apply' ]]; then
    if [[ "${CDX_AI_BUILDER_APPROVAL-}" != 'SYNC_C_DM_BUILDER_V1' ]]; then
        printf 'DENIED: exact sync approval required\n' >&2
        exit 78
    fi
    cdx_current="$(ssh -S "$cdx_socket" -o BatchMode=yes root@121.43.241.161 \
        "sha256sum '$cdx_remote_file' | cut -d' ' -f1")"
    [[ "$cdx_current" == "$cdx_old_sha" ]]
    cdx_backup="${CDX_AI_BUILDER_BACKUP_DIR-}"
    [[ "$cdx_backup" =~ ^/tmp/cdx-ai-builder-c\.[A-Za-z0-9]{6}$ ]]
    printf -v cdx_backup_quoted '%q' "$cdx_backup"
    ssh -S "$cdx_socket" -o BatchMode=yes root@121.43.241.161 \
        "set -e; test \"\$(stat -c %a $cdx_backup_quoted)\" = 700; test \"\$(stat -c %a $cdx_backup_quoted/DmBuilder.php)\" = 600; test \"\$(sha256sum $cdx_backup_quoted/DmBuilder.php | cut -d' ' -f1)\" = '$cdx_old_sha'"
    printf 'C_BUILDER_PRIVATE_BACKUP_READY path=%s old_sha=%s\n' "$cdx_backup" "$cdx_old_sha"
    cdx_stage="$cdx_backup/DmBuilder.new.php"
    cdx_target_stage="$cdx_remote_file.cdx-$cdx_new_sha.tmp"
    scp -o "ControlPath=$cdx_socket" -o BatchMode=yes \
        "$cdx_source" "root@121.43.241.161:$cdx_stage"
    ssh -S "$cdx_socket" -o BatchMode=yes root@121.43.241.161 \
        "set -e; test ! -L '$cdx_remote_file'; test ! -e '$cdx_target_stage'; test \"\$(sha256sum '$cdx_stage' | cut -d' ' -f1)\" = '$cdx_new_sha'; /www/server/php/74/bin/php -l '$cdx_stage'; test \"\$(sha256sum '$cdx_remote_file' | cut -d' ' -f1)\" = '$cdx_old_sha'; cp -p '$cdx_stage' '$cdx_target_stage'; test \"\$(sha256sum '$cdx_target_stage' | cut -d' ' -f1)\" = '$cdx_new_sha'; mv -f '$cdx_target_stage' '$cdx_remote_file'; test \"\$(sha256sum '$cdx_remote_file' | cut -d' ' -f1)\" = '$cdx_new_sha'; /www/server/php/74/bin/php -l '$cdx_remote_file'"
    printf 'C_BUILDER_SYNCED new_sha=%s backup=%s business_http=0 business_dml=0\n' \
        "$cdx_new_sha" "$cdx_backup"
    exit 0
fi

if [[ "${CDX_AI_BUILDER_APPROVAL-}" != 'ROLLBACK_C_DM_BUILDER_V1' ]]; then
    printf 'DENIED: exact rollback approval required\n' >&2
    exit 78
fi
cdx_backup="${2-}"
[[ "$cdx_backup" =~ ^/tmp/cdx-ai-builder-c\.[A-Za-z0-9]{6}$ ]]
printf -v cdx_backup_quoted '%q' "$cdx_backup"
ssh -S "$cdx_socket" -o BatchMode=yes root@121.43.241.161 \
    "set -e; test \"\$(sha256sum $cdx_backup_quoted/DmBuilder.php | cut -d' ' -f1)\" = '$cdx_old_sha'; test \"\$(sha256sum '$cdx_remote_file' | cut -d' ' -f1)\" = '$cdx_new_sha'; cp -p $cdx_backup_quoted/DmBuilder.php '$cdx_remote_file'; test \"\$(sha256sum '$cdx_remote_file' | cut -d' ' -f1)\" = '$cdx_old_sha'; /www/server/php/74/bin/php -l '$cdx_remote_file'"
printf 'C_BUILDER_ROLLED_BACK old_sha=%s business_http=0 business_dml=0\n' "$cdx_old_sha"