#!/usr/bin/env bash

set -Eeuo pipefail
export LANG=C
umask 077

EXPECTED_HOSTNAME="sqjcDB01"
EXPECTED_IPV4="10.2.208.106"
BACKUP_ROOT="/var/backups/zhct-q060"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
UPDATE_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
SOURCE_VERIFY="${UPDATE_ROOT}/deployment-records/Q-060/scripts/q060-verify-locked-assets.sh"
TARGET_VERIFY="/root/q060-verify-locked-assets.sh"
OLD_VERIFY_SHA256="0062d0c21aa1f382868db35efa972553b13262f54cac8996f6fb9340da48bbe1"
NEW_VERIFY_SHA256="ba2f0f95047718deae760429d0304e66f56f2b46592fde4877cd7b2d810900d5"

die() {
  printf 'ERROR: %s\n' "$*" >&2
  exit 1
}

file_sha256() {
  sha256sum "$1" | awk '{print $1}'
}

[[ "${EUID}" -eq 0 ]] || die "must run as root"
[[ $# -eq 1 ]] || die "usage: $0 <q060-baseline-run-id>"
RUN_ID="$1"
[[ "${RUN_ID}" =~ ^[0-9]{8}T[0-9]{6}[+-][0-9]{4}$ ]] || die "invalid run id"
EVIDENCE_DIR="${BACKUP_ROOT}/${RUN_ID}"
VERIFY_ROOT="/var/tmp/zhct-q060-verify-${RUN_ID}"
FAILURE_DIR="${EVIDENCE_DIR}/failed-verify-path-check-attempt1"

[[ "$(hostname -s)" == "${EXPECTED_HOSTNAME}" ]] || die "hostname mismatch"
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 |
  grep -Fxq "${EXPECTED_IPV4}" || die "expected IPv4 is not configured"
[[ -d "${VERIFY_ROOT}" ]] || die "failed verification root is missing"
[[ ! -e "${FAILURE_DIR}" ]] || die "failed verification evidence directory already exists"
[[ ! -e "${EVIDENCE_DIR}/locked-assets-verification-result.env" ]] || \
  die "locked-assets verification result already exists"
[[ -s "${SOURCE_VERIFY}" ]] || die "corrected verify source is missing"
[[ "$(file_sha256 "${SOURCE_VERIFY}")" == "${NEW_VERIFY_SHA256}" ]] || \
  die "corrected verify source SHA256 mismatch"
[[ "$(file_sha256 "${TARGET_VERIFY}")" == "${OLD_VERIFY_SHA256}" ]] || \
  die "current target verify SHA256 mismatch"

install -d -m 0700 "${FAILURE_DIR}"
install -m 0600 "${TARGET_VERIFY}" "${FAILURE_DIR}/q060-verify-locked-assets.sh"
while IFS= read -r -d '' evidence_file; do
  mv "${evidence_file}" "${FAILURE_DIR}/$(basename "${evidence_file}")"
done < <(find "${EVIDENCE_DIR}" -maxdepth 1 -type f -name 'verify-*' -print0 | sort -z)
mv "${VERIFY_ROOT}" "${FAILURE_DIR}/verify-root"
sha256sum "${FAILURE_DIR}/q060-verify-locked-assets.sh" \
  >"${FAILURE_DIR}/failed-verify-script.sha256"

install -m 0750 "${SOURCE_VERIFY}" "${TARGET_VERIFY}"
[[ "$(file_sha256 "${TARGET_VERIFY}")" == "${NEW_VERIFY_SHA256}" ]] || \
  die "installed corrected verify SHA256 mismatch"
sha256sum "${TARGET_VERIFY}" >"${EVIDENCE_DIR}/verify-path-fix-after.sha256"

printf 'Q060_VERIFY_PATH_FIX_APPLIED\n'
exec bash "${TARGET_VERIFY}" "${RUN_ID}"