#!/usr/bin/env bash

set -Eeuo pipefail
export LANG=C

EXPECTED_HOSTNAME="sqjcapp01"
EXPECTED_IPV4="10.2.203.104"
BACKUP_ROOT="/var/backups/zhct-q050"
BUNDLE_ROOT="/opt/zhct-deploy"
PACKAGE_ROOT="${BUNDLE_ROOT}/packages"
MYSQL_ARCHIVE="mysql-5.6.51-linux-glibc2.12-x86_64.tar.gz"
MYSQL_EXPECTED_BYTES=341603885

die() {
  printf 'ERROR: %s\n' "$*" >&2
  exit 1
}

download_locked() {
  local artifact="$1"
  local expected_sha="$2"
  local url="$3"
  local target="${PACKAGE_ROOT}/${artifact}"
  local part="${target}.part"

  if [[ -f "${target}" ]] && \
    [[ "$(sha256sum "${target}" | awk '{print $1}')" == "${expected_sha}" ]]; then
    printf 'REUSE %s\n' "${artifact}"
    return
  fi
  rm -f -- "${part}"
  curl --fail --location --show-error --silent \
    --proto '=https' --tlsv1.2 --connect-timeout 15 --max-time 3600 \
    --retry 3 --retry-delay 3 --output "${part}" "${url}"
  [[ "$(sha256sum "${part}" | awk '{print $1}')" == "${expected_sha}" ]] || \
    die "SHA256 mismatch: ${artifact}"
  mv "${part}" "${target}"
  chmod 0640 "${target}"
  printf 'DOWNLOADED %s\n' "${artifact}"
}

[[ "${EUID}" -eq 0 ]] || die "must run as root"
[[ $# -eq 1 ]] || die "usage: $0 <q050-baseline-run-id>"
RUN_ID="$1"
[[ "${RUN_ID}" =~ ^[0-9]{8}T[0-9]{6}[+-][0-9]{4}$ ]] || die "invalid run id"
EVIDENCE_DIR="${BACKUP_ROOT}/${RUN_ID}"

[[ "$(hostname -s)" == "${EXPECTED_HOSTNAME}" ]] || die "hostname mismatch"
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 | \
  grep -Fxq "${EXPECTED_IPV4}" || die "expected IPv4 is not configured"
[[ -d "${EVIDENCE_DIR}/baseline" ]] || die "Q-050 baseline evidence is missing"
grep -Fxq 'target_listener_check=PASS' "${EVIDENCE_DIR}/result.env" || \
  die "Q-050 baseline target listener gate is not PASS"
[[ -d "${BUNDLE_ROOT}/common" && -d "${BUNDLE_ROOT}/roles/app" ]] || \
  die "App role framework is missing"
[[ "$(tr -d '\r\n' <"${BUNDLE_ROOT}/.source-commit")" == "fb48b4d4" ]] || \
  die "App role framework source marker mismatch"

umask 077
install -d -m 0750 "${PACKAGE_ROOT}"

download_locked \
  nginx-1.26.3.tar.gz \
  69ee2b237744036e61d24b836668aad3040dda461fe6f570f1787eab570c75aa \
  https://nginx.org/download/nginx-1.26.3.tar.gz
download_locked \
  php-7.3.33.tar.bz2 \
  f412487d7d953437e7978a0d7b6ec99bf4a85cf3378014438a8577b89535451a \
  https://www.php.net/distributions/php-7.3.33.tar.bz2
download_locked \
  php-7.4.33.tar.bz2 \
  4e8117458fe5a475bf203128726b71bcbba61c42ad463dffadee5667a198a98a \
  https://www.php.net/distributions/php-7.4.33.tar.bz2
download_locked \
  redis-5.3.5.tgz \
  d55fa5cc699198917ba2bdc827da632ad77f009ba2642d2750456a976dbe5989 \
  https://pecl.php.net/get/redis-5.3.5.tgz
download_locked \
  Mosquitto-0.4.0.tgz \
  eec599110f733afe5e0331a85d8feb354ec079b088bdca2dd81a587c5b50f8e4 \
  https://pecl.php.net/get/Mosquitto-0.4.0.tgz
download_locked \
  mosquitto-1.6.15.tar.gz \
  5ff2271512f745bf1a451072cd3768a5daed71e90c5179fae12b049d6c02aa0f \
  https://mosquitto.org/files/source/mosquitto-1.6.15.tar.gz
download_locked \
  redis-5.0.14.tar.gz \
  3ea5024766d983249e80d4aa9457c897a9f079957d0fb1f35682df233f997f32 \
  https://download.redis.io/releases/redis-5.0.14.tar.gz

SUPERVISOR_WHEEL="${PACKAGE_ROOT}/supervisor-4.3.0-py2.py3-none-any.whl"
if [[ ! -f "${SUPERVISOR_WHEEL}" ]] || \
  [[ "$(sha256sum "${SUPERVISOR_WHEEL}" | awk '{print $1}')" != \
    "0bcb763fddafba410f35cbde226aa7f8514b9fb82eb05a0c85f6588d1c13f8db" ]]; then
  SUPERVISOR_TMP=$(mktemp -d "${PACKAGE_ROOT}/.supervisor-download.XXXXXX")
  python3 -m pip download --disable-pip-version-check --no-deps \
    --only-binary=:all: --dest "${SUPERVISOR_TMP}" supervisor==4.3.0
  [[ -f "${SUPERVISOR_TMP}/supervisor-4.3.0-py2.py3-none-any.whl" ]] || \
    die "Supervisor wheel download did not produce the expected filename"
  [[ "$(sha256sum "${SUPERVISOR_TMP}/supervisor-4.3.0-py2.py3-none-any.whl" | awk '{print $1}')" == \
    "0bcb763fddafba410f35cbde226aa7f8514b9fb82eb05a0c85f6588d1c13f8db" ]] || \
    die "Supervisor wheel SHA256 mismatch"
  mv "${SUPERVISOR_TMP}/supervisor-4.3.0-py2.py3-none-any.whl" "${SUPERVISOR_WHEEL}"
  rmdir "${SUPERVISOR_TMP}"
fi
chmod 0640 "${SUPERVISOR_WHEEL}"

MYSQL_TARGET="${PACKAGE_ROOT}/${MYSQL_ARCHIVE}"
MYSQL_PART="${MYSQL_TARGET}.part"
if [[ ! -f "${MYSQL_TARGET}" ]]; then
  rm -f -- "${MYSQL_PART}"
  curl --fail --location --show-error --silent \
    --proto '=https' --tlsv1.2 --connect-timeout 15 --max-time 3600 \
    --retry 3 --retry-delay 3 --output "${MYSQL_PART}" \
    "https://downloads.mysql.com/archives/get/p/23/file/${MYSQL_ARCHIVE}"
  [[ "$(stat -c '%s' "${MYSQL_PART}")" -eq "${MYSQL_EXPECTED_BYTES}" ]] || \
    die "MySQL archive size mismatch"
  mv "${MYSQL_PART}" "${MYSQL_TARGET}"
fi
[[ "$(stat -c '%s' "${MYSQL_TARGET}")" -eq "${MYSQL_EXPECTED_BYTES}" ]] || \
  die "MySQL archive size mismatch"
tar -tzf "${MYSQL_TARGET}" >"${EVIDENCE_DIR}/mysql-archive-members.txt"
grep -Fxq 'mysql-5.6.51-linux-glibc2.12-x86_64/bin/mysql' \
  "${EVIDENCE_DIR}/mysql-archive-members.txt" || die "MySQL client is missing"
grep -Fxq 'mysql-5.6.51-linux-glibc2.12-x86_64/bin/mysqldump' \
  "${EVIDENCE_DIR}/mysql-archive-members.txt" || die "mysqldump is missing"
grep -Fxq 'mysql-5.6.51-linux-glibc2.12-x86_64/bin/mysqladmin' \
  "${EVIDENCE_DIR}/mysql-archive-members.txt" || die "mysqladmin is missing"
chmod 0640 "${MYSQL_TARGET}"

[[ -f "${PACKAGE_ROOT}/lnmp2.2-from-git-20260706.tar.gz" ]] || \
  die "local LNMP reference archive is not uploaded"
[[ "$(sha256sum "${PACKAGE_ROOT}/lnmp2.2-from-git-20260706.tar.gz" | awk '{print $1}')" == \
  "9cdc130f859bfca6cbd138950128fda358b88fb1ebadad4f937ebc4560fe990b" ]] || \
  die "local LNMP reference SHA256 mismatch"

find "${PACKAGE_ROOT}" -maxdepth 1 -type f \
  ! -name '*.part' -printf '%f\t%s\t%TY-%Tm-%TdT%TH:%TM:%TS\n' \
  | sort >"${EVIDENCE_DIR}/source-assets-inventory.tsv"
find "${PACKAGE_ROOT}" -maxdepth 1 -type f \
  ! -name '*.part' -print0 | sort -z | xargs -0 sha256sum \
  >"${EVIDENCE_DIR}/source-assets.sha256"

MYSQL_SHA256="$(sha256sum "${MYSQL_TARGET}" | awk '{print $1}')"
{
  printf 'captured_at=%s\n' "$(date --iso-8601=seconds)"
  printf 'locked_source_asset_count=10\n'
  printf 'mysql_archive=%s\n' "${MYSQL_ARCHIVE}"
  printf 'mysql_archive_bytes=%s\n' "${MYSQL_EXPECTED_BYTES}"
  printf 'mysql_archive_sha256=%s\n' "${MYSQL_SHA256}"
  printf 'mysql_required_client_members=PASS\n'
  printf 'source_asset_download=PASS\n'
  printf 'rpm_download=NOT_PERFORMED\n'
  printf 'install_execution=NOT_PERFORMED\n'
} >"${EVIDENCE_DIR}/source-assets-result.env"
chmod 0600 "${EVIDENCE_DIR}"/source-assets*

printf 'Q050_SOURCE_ASSETS_OK\n'
printf 'MYSQL_ARCHIVE_SHA256=%s\n' "${MYSQL_SHA256}"