#!/usr/bin/env bash

set -Eeuo pipefail

EXPECTED_HOSTNAME="sqjcnginx01"
EXPECTED_IPV4="10.2.203.102"
EXPECTED_TAR_SHA256="f74941f6328c752eeefb5fe082c4366dfed5c91ecad36d31ba7e11b7d2cac2d5"
EXPECTED_SOURCE_COMMIT="47584918681b8aad36fee3c9eade5cd919c702ab"
EXPECTED_RPM_MANIFEST_SHA256="0ef1b62af801d782e8331b608b4b0580e0721a7553e913ab17686d4dc32dee3d"
BUNDLE_ROOT="/opt/zhct-deploy"
FRAMEWORK_TAR="/root/sanquan-nginx-q040-role-framework-47584918.tar.gz"
SOURCE_MARKER="/root/q040-source-commit-47584918"
FRAMEWORK_MARKER="/root/q040-framework-bundle-sha256-47584918"
EVIDENCE_DIR="/var/backups/zhct-q040/20260722T203557+0800"
BACKUP_DIR="${EVIDENCE_DIR}/nginx-role-framework-before-47584918"

die() {
  printf 'ERROR: %s\n' "$*" >&2
  exit 1
}

[[ "${EUID}" -eq 0 ]] || die "must run as root"
[[ "$(hostname -s)" == "${EXPECTED_HOSTNAME}" ]] || die "hostname mismatch"
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 | \
  grep -Fxq "${EXPECTED_IPV4}" || die "expected IPv4 is not configured"
[[ "$(sha256sum "${FRAMEWORK_TAR}" | awk '{print $1}')" == "${EXPECTED_TAR_SHA256}" ]] || \
  die "framework tar SHA256 mismatch"
[[ "$(tr -d '\r\n' <"${SOURCE_MARKER}")" == "${EXPECTED_SOURCE_COMMIT}" ]] || \
  die "source marker mismatch"
[[ "$(tr -d '\r\n' <"${FRAMEWORK_MARKER}")" == "${EXPECTED_TAR_SHA256}" ]] || \
  die "framework marker mismatch"
[[ "$(sha256sum "${BUNDLE_ROOT}/packages/rpms.sha256" | awk '{print $1}')" == "${EXPECTED_RPM_MANIFEST_SHA256}" ]] || \
  die "18-RPM manifest SHA256 mismatch"
[[ $(wc -l <"${BUNDLE_ROOT}/packages/rpms.sha256") -eq 18 ]] || \
  die "RPM manifest does not contain 18 rows"
[[ ! -e "${BACKUP_DIR}" ]] || die "framework backup directory already exists"

umask 077
install -d -m 0700 "${BACKUP_DIR}" "${BACKUP_DIR}/roles"
[[ -d "${BUNDLE_ROOT}/common" ]] || die "existing common framework is missing"
[[ -d "${BUNDLE_ROOT}/roles/nginx" ]] || die "existing Nginx role is missing"
mv "${BUNDLE_ROOT}/common" "${BACKUP_DIR}/common"
mv "${BUNDLE_ROOT}/roles/nginx" "${BACKUP_DIR}/roles/nginx"
for file in README.md bundle-sha256.sh .source-commit .framework-bundle-sha256; do
  [[ -f "${BUNDLE_ROOT}/${file}" ]] && cp -p "${BUNDLE_ROOT}/${file}" "${BACKUP_DIR}/${file}"
done

tar -xzf "${FRAMEWORK_TAR}" -C "${BUNDLE_ROOT}"
chown -R root "${BUNDLE_ROOT}/common" "${BUNDLE_ROOT}/roles/nginx"
chgrp -R root "${BUNDLE_ROOT}/common" "${BUNDLE_ROOT}/roles/nginx"
install -m 0640 "${SOURCE_MARKER}" "${BUNDLE_ROOT}/.source-commit"
install -m 0640 "${FRAMEWORK_MARKER}" "${BUNDLE_ROOT}/.framework-bundle-sha256"

metadata_artifact=$(find "${BUNDLE_ROOT}/common" "${BUNDLE_ROOT}/roles/nginx" \
  -type f \( -name '._*' -o -name '.DS_Store' \) -print -quit)
[[ -z "${metadata_artifact}" ]] || die "framework contains metadata artifact: ${metadata_artifact}"
while IFS= read -r -d '' script; do
  bash -n "${script}"
done < <(find "${BUNDLE_ROOT}/common" "${BUNDLE_ROOT}/roles/nginx" \
  -type f -name '*.sh' -print0 | sort -z)

(
  cd "${BUNDLE_ROOT}"
  sha256sum -c roles/nginx/manifests/packages.sha256
) >"${EVIDENCE_DIR}/framework-47584918-nginx-packages-sha256-check.txt"
(
  cd "${BUNDLE_ROOT}/packages"
  sha256sum -c rpms.sha256
) >"${EVIDENCE_DIR}/framework-47584918-rpms-sha256-check.txt"

{
  printf 'captured_at=%s\n' "$(date --iso-8601=seconds)"
  printf 'source_commit=%s\n' "${EXPECTED_SOURCE_COMMIT}"
  printf 'framework_bundle_sha256=%s\n' "${EXPECTED_TAR_SHA256}"
  printf 'rpm_manifest_sha256=%s\n' "${EXPECTED_RPM_MANIFEST_SHA256}"
  printf 'rpm_count=18\n'
  printf 'metadata_artifact_count=0\n'
  printf 'shell_syntax_check=PASS\n'
  printf 'nginx_package_asset_check=PASS\n'
  printf 'rpm_asset_check=PASS\n'
  printf 'install_execution=NOT_PERFORMED\n'
} >"${EVIDENCE_DIR}/framework-47584918-refresh-result.env"

chmod -R go-rwx "${BACKUP_DIR}"
chmod 0600 "${EVIDENCE_DIR}"/framework-47584918-*

printf 'Q040_NGINX_FRAMEWORK_REFRESH_OK\n'
cat "${EVIDENCE_DIR}/framework-47584918-refresh-result.env"