#!/usr/bin/env bash

set -Eeuo pipefail
export LANG=C
umask 077

EXPECTED_HOSTNAME="sqjcDB01"
EXPECTED_IPV4="10.2.208.106"
BACKUP_ROOT="/var/backups/zhct-q060"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
UPDATE_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
SOURCE_RUNTIME="${UPDATE_ROOT}/deployment-assets/common/lib/runtime.sh"
SOURCE_VERIFY="${UPDATE_ROOT}/deployment-records/Q-060/scripts/q060-verify-locked-assets.sh"
SOURCE_FINALIZE="${UPDATE_ROOT}/deployment-records/Q-060/scripts/q060-finalize-locked-manifests.sh"
TARGET_RUNTIME="/opt/zhct-deploy/common/lib/runtime.sh"
TARGET_VERIFY="/root/q060-verify-locked-assets.sh"
TARGET_FINALIZE="/root/q060-finalize-locked-manifests.sh"

OLD_RUNTIME_SHA256="89e5149c516af624dd56b3ef8aaa389a4f2447a68dfe989978c61c459d859162"
OLD_VERIFY_SHA256="b5873eb853330717feffe2d86662427a141752c0db5bc2c4cbfd1e6ee3622e62"
OLD_FINALIZE_SHA256="673cfa8061be315e266e830e8fe69a13bc73e2c806685db18b85c5ee876ebad7"
NEW_RUNTIME_SHA256="4c06e4ad325de7241607b06d93c99c2f35f3422bfcbdbeeb43b530f2053f4bb6"
NEW_VERIFY_SHA256="ba2f0f95047718deae760429d0304e66f56f2b46592fde4877cd7b2d810900d5"
NEW_FINALIZE_SHA256="3aa2d61e05cb3f2adb20dac63d719f3c2b33acbf4ede6fcaf55dc002fe6c2a3c"

die() {
  printf 'ERROR: %s\n' "$*" >&2
  exit 1
}

file_sha256() {
  sha256sum "$1" | awk '{print $1}'
}

[[ "${EUID}" -eq 0 ]] || die "must run as root"
[[ $# -eq 1 ]] || die "usage: $0 <q060-baseline-run-id>"
RUN_ID="$1"
[[ "${RUN_ID}" =~ ^[0-9]{8}T[0-9]{6}[+-][0-9]{4}$ ]] || die "invalid run id"
EVIDENCE_DIR="${BACKUP_ROOT}/${RUN_ID}"
BACKUP_DIR="${EVIDENCE_DIR}/runtime-update-before"

[[ "$(hostname -s)" == "${EXPECTED_HOSTNAME}" ]] || die "hostname mismatch"
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 |
  grep -Fxq "${EXPECTED_IPV4}" || die "expected IPv4 is not configured"
[[ -s "${EVIDENCE_DIR}/rpm-closure-result.env" ]] || die "RPM closure result is missing"
grep -Fxq 'fresh_installroot_dependency_resolution=PASS_ASSUMENO' \
  "${EVIDENCE_DIR}/rpm-closure-result.env" || die "fresh-install closure gate is not PASS"
grep -Fxq 'install_execution=NOT_PERFORMED' \
  "${EVIDENCE_DIR}/rpm-closure-result.env" || die "RPM closure records an installation"
[[ ! -e "${BACKUP_DIR}" ]] || die "runtime update backup already exists"

for source_file in "${SOURCE_RUNTIME}" "${SOURCE_VERIFY}" "${SOURCE_FINALIZE}"; do
  [[ -s "${source_file}" ]] || die "update source is missing: ${source_file}"
done
[[ "$(file_sha256 "${SOURCE_RUNTIME}")" == "${NEW_RUNTIME_SHA256}" ]] || \
  die "source runtime SHA256 mismatch"
[[ "$(file_sha256 "${SOURCE_VERIFY}")" == "${NEW_VERIFY_SHA256}" ]] || \
  die "source verify SHA256 mismatch"
[[ "$(file_sha256 "${SOURCE_FINALIZE}")" == "${NEW_FINALIZE_SHA256}" ]] || \
  die "source finalize SHA256 mismatch"
[[ "$(file_sha256 "${TARGET_RUNTIME}")" == "${OLD_RUNTIME_SHA256}" ]] || \
  die "target runtime is not the expected staged baseline"
[[ "$(file_sha256 "${TARGET_VERIFY}")" == "${OLD_VERIFY_SHA256}" ]] || \
  die "target verify script is not the expected staged baseline"
[[ "$(file_sha256 "${TARGET_FINALIZE}")" == "${OLD_FINALIZE_SHA256}" ]] || \
  die "target finalize script is not the expected staged baseline"

install -d -m 0700 "${BACKUP_DIR}"
install -m 0600 "${TARGET_RUNTIME}" "${BACKUP_DIR}/runtime.sh"
install -m 0600 "${TARGET_VERIFY}" "${BACKUP_DIR}/q060-verify-locked-assets.sh"
install -m 0600 "${TARGET_FINALIZE}" "${BACKUP_DIR}/q060-finalize-locked-manifests.sh"
sha256sum "${BACKUP_DIR}/runtime.sh" \
  "${BACKUP_DIR}/q060-verify-locked-assets.sh" \
  "${BACKUP_DIR}/q060-finalize-locked-manifests.sh" \
  >"${BACKUP_DIR}/SHA256SUMS"

install -m 0644 "${SOURCE_RUNTIME}" "${TARGET_RUNTIME}"
install -m 0750 "${SOURCE_VERIFY}" "${TARGET_VERIFY}"
install -m 0750 "${SOURCE_FINALIZE}" "${TARGET_FINALIZE}"
[[ "$(file_sha256 "${TARGET_RUNTIME}")" == "${NEW_RUNTIME_SHA256}" ]] || \
  die "installed runtime SHA256 mismatch"
[[ "$(file_sha256 "${TARGET_VERIFY}")" == "${NEW_VERIFY_SHA256}" ]] || \
  die "installed verify SHA256 mismatch"
[[ "$(file_sha256 "${TARGET_FINALIZE}")" == "${NEW_FINALIZE_SHA256}" ]] || \
  die "installed finalize SHA256 mismatch"
sha256sum "${TARGET_RUNTIME}" "${TARGET_VERIFY}" "${TARGET_FINALIZE}" \
  >"${EVIDENCE_DIR}/runtime-update-after.sha256"
{
  printf 'captured_at=%s\n' "$(date --iso-8601=seconds)"
  printf 'runtime_update=PASS\n'
  printf 'rpm_selection=MISSING_PACKAGE_NAMES_ONLY\n'
  printf 'mysql56_gpg_policy=PASS_VALID_SIGNATURE_EXPIRED_PINNED_KEY\n'
  printf 'install_execution=NOT_PERFORMED\n'
  printf 'post_clone_execution=NOT_PERFORMED\n'
} >"${EVIDENCE_DIR}/runtime-update-result.env"
chmod 0600 "${EVIDENCE_DIR}/runtime-update-after.sha256" \
  "${EVIDENCE_DIR}/runtime-update-result.env"

printf 'Q060_RUNTIME_UPDATE_OK\n'
cat "${EVIDENCE_DIR}/runtime-update-result.env"