#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

NEW_RUN=${1:-$(date '+%Y%m%dT%H%M%S%z')}
EVIDENCE_DIR="/var/backups/zhct-q062/${NEW_RUN}-mysql56-directory-fix"
VERIFY_SCRIPT=/root/q062-verify-20260727/deployment-records/Q-062/scripts/q062-verify-mysql80-temporary.sh
VERIFY_SHA=ebc7e64469e18a2b8990eabece6728364980b953ed965a739d93c2f458766a92
MYSQL56=/opt/mysql/5.6.51

die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
[[ $(id -u) -eq 0 ]] || die "root required"
[[ "$NEW_RUN" =~ ^[0-9]{8}T[0-9]{6}[+-][0-9]{4}$ ]] || die "invalid run id"
[[ ! -e "$EVIDENCE_DIR" && ! -e "/var/backups/zhct-q062/$NEW_RUN" ]] ||
  die "new evidence already exists"
install -d -m 0700 "$EVIDENCE_DIR"
[[ $(sha256sum "$VERIFY_SCRIPT" | awk '{print $1}') == "$VERIFY_SHA" ]] ||
  die "unexpected verify script"
bash -n "$VERIFY_SCRIPT"
pgrep -x mysqld >/dev/null && die "mysqld is running"
ss -lntup >"$EVIDENCE_DIR/listeners-before.txt"
! grep -Eq ':(3306|3308|9201|9202|33060)([[:space:]]|$)' "$EVIDENCE_DIR/listeners-before.txt" ||
  die "target listener exists"

for v in 5.6.51 8.0.46; do
  [[ $(stat -c '%a:%U:%G' "/opt/mysql/$v") == 755:root:root ]] ||
    die "unexpected prefix metadata: $v"
  matchpathcon -V "/opt/mysql/$v" "/opt/mysql/$v/bin/mysqld" \
    >>"$EVIDENCE_DIR/matchpathcon-before.txt" 2>&1
done
find "$MYSQL56" -type d ! -perm -0001 -printf '%m	%U	%G	%p\n' \
  >"$EVIDENCE_DIR/nontraversable-before.tsv"
[[ $(wc -l <"$EVIDENCE_DIR/nontraversable-before.tsv") -eq 194 ]] ||
  die "unexpected non-traversable directory count"
find "$MYSQL56/bin" "$MYSQL56/lib" "$MYSQL56/lib/plugin" -type f ! -perm -0004 -print \
  >"$EVIDENCE_DIR/nonreadable-runtime-files.txt" 2>/dev/null
[[ ! -s "$EVIDENCE_DIR/nonreadable-runtime-files.txt" ]] ||
  die "runtime file is not world-readable"

find "$MYSQL56" -type d ! -perm -0001 -exec chmod o+rx {} +
restorecon -RF "$MYSQL56"
find "$MYSQL56" -type d ! -perm -0001 -print >"$EVIDENCE_DIR/nontraversable-after.txt"
[[ ! -s "$EVIDENCE_DIR/nontraversable-after.txt" ]] ||
  die "non-traversable directory remains"
runuser -u mysql -- test -x /opt/mysql/5.6.51/bin/mysqld
runuser -u mysql -- test -x /opt/mysql/8.0.46/bin/mysqld
runuser -u mysql -- test -r /opt/mysql/8.0.46/lib/plugin/component_reference_cache.so
printf 'mysql56_directory_fix=PASS\nmysql_user_runtime_access=PASS\n' >"$EVIDENCE_DIR/result.env"

bash "$VERIFY_SCRIPT" "$NEW_RUN"
RESULT="/var/backups/zhct-q062/$NEW_RUN"
grep -Fxq 'mysql80_sql_read_write=PASS' "$RESULT/result.env"
grep -Fxq 'temporary_mysql_stopped=PASS' "$RESULT/result.env"
if grep -Eqi 'Permission denied|Cannot load component|Can.t open shared library' \
  "$RESULT/mysql80-init.log" "$RESULT/mysql80-start.console.log" "$RESULT/mysql80-error.log"; then
  die "component/shared-library error remains"
fi
printf 'Q062_MYSQL56_DIRECTORY_FIX_AND_RESUME_OK\nrun_id=%s\nrepair_evidence=%s\nverify_evidence=%s\n' \
  "$NEW_RUN" "$EVIDENCE_DIR" "$RESULT"