#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

OLD_RUN=20260727T152200+0800
NEW_RUN=${1:-$(date '+%Y%m%dT%H%M%S%z')}
OLD_EVIDENCE="/var/backups/zhct-q062/$OLD_RUN"
REPAIR_EVIDENCE="/var/backups/zhct-q062/${NEW_RUN}-prefix-repair"
TARGET_VERIFY=/root/q062-verify-20260727/deployment-records/Q-062/scripts/q062-verify-mysql80-temporary.sh
SOURCE_VERIFY=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/q062-verify-mysql80-temporary.sh
OLD_VERIFY_SHA=915e7752ffc47861405708d22665477aaab9eab4417931bda36511726b0f56c6

die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
[[ $(id -u) -eq 0 ]] || die "root required"
[[ "$NEW_RUN" =~ ^[0-9]{8}T[0-9]{6}[+-][0-9]{4}$ ]] || die "invalid run id"
[[ ! -e "$REPAIR_EVIDENCE" && ! -e "/var/backups/zhct-q062/$NEW_RUN" ]] ||
  die "new evidence already exists"
install -d -m 0700 "$REPAIR_EVIDENCE"

grep -Fxq 'mysql80_temporary_initialize=PASS' "$OLD_EVIDENCE/result.env" ||
  die "old run result missing"
[[ $(sha256sum "$TARGET_VERIFY" | awk '{print $1}') == "$OLD_VERIFY_SHA" ]] ||
  die "unexpected current verify script"
bash -n "$SOURCE_VERIFY"
pgrep -x mysqld >/dev/null && die "mysqld is running"
ss -lntup >"$REPAIR_EVIDENCE/listeners-before.txt"
! grep -Eq ':(3306|3308|9201|9202|33060)([[:space:]]|$)' "$REPAIR_EVIDENCE/listeners-before.txt" ||
  die "target listener exists"

for v in 5.6.51 8.0.46; do
  stat -c '%a	%U	%G	%C	%n' "/opt/mysql/$v"
  [[ $(stat -c '%a:%U:%G' "/opt/mysql/$v") == 750:root:root ]] ||
    die "unexpected prefix metadata: $v"
  [[ $(stat -c '%C' "/opt/mysql/$v") == *:user_tmp_t:* ]] ||
    die "unexpected prefix SELinux label: $v"
done >"$REPAIR_EVIDENCE/prefix-metadata-before.tsv"

install -m 0700 -o root -g root "$SOURCE_VERIFY" "$TARGET_VERIFY"
sha256sum "$TARGET_VERIFY" >"$REPAIR_EVIDENCE/verify-script-after.sha256"
chmod 0755 /opt/mysql/5.6.51 /opt/mysql/8.0.46
restorecon -RFv /opt/mysql/5.6.51 /opt/mysql/8.0.46 \
  >"$REPAIR_EVIDENCE/restorecon.txt" 2>&1

for v in 5.6.51 8.0.46; do
  stat -c '%a	%U	%G	%C	%n' "/opt/mysql/$v"
  matchpathcon -V "/opt/mysql/$v" "/opt/mysql/$v/bin/mysqld"
done >"$REPAIR_EVIDENCE/prefix-metadata-after.tsv" 2>&1
runuser -u mysql -- test -x /opt/mysql/5.6.51/bin/mysqld
runuser -u mysql -- test -x /opt/mysql/8.0.46/bin/mysqld
runuser -u mysql -- test -r /opt/mysql/8.0.46/lib/plugin/component_reference_cache.so
printf 'prefix_mode_repair=PASS\nselinux_restorecon=PASS\nmysql_user_access=PASS\n' \
  >"$REPAIR_EVIDENCE/result.env"

bash "$TARGET_VERIFY" "$NEW_RUN"
grep -Fxq 'mysql80_sql_read_write=PASS' "/var/backups/zhct-q062/$NEW_RUN/result.env"
grep -Fxq 'temporary_mysql_stopped=PASS' "/var/backups/zhct-q062/$NEW_RUN/result.env"
printf 'Q062_PREFIX_REPAIR_AND_RESUME_OK\nrun_id=%s\nrepair_evidence=%s\nverify_evidence=%s\n' \
  "$NEW_RUN" "$REPAIR_EVIDENCE" "/var/backups/zhct-q062/$NEW_RUN"