#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

readonly TARGET_HOST=sqjcnginx02
readonly TARGET_IP=10.2.203.103
readonly Q102_RUN_ID=q102-manual-20260729T071640Z
readonly Q102_ENTRY=/root/q102-nginx02-activation/q102-nginx02.sh
readonly Q102_EVIDENCE_DIR="/var/backups/zhct-q102/evidence/${Q102_RUN_ID}"
readonly AUDIT_ROOT=/root/q102-manual-upload-audit
readonly AUDIT_LOG="${AUDIT_ROOT}/${Q102_RUN_ID}-execute-verify-archive.log"

mkdir -p "$AUDIT_ROOT"
chmod 0700 "$AUDIT_ROOT"
exec > >(tee -a "$AUDIT_LOG") 2>&1

stage=initial
rollback_status=NOT_REQUIRED

finish() {
  rc=$?
  trap - EXIT
  printf 'Q102_ACTIVATION_WRAPPER_STAGE=%s\n' "$stage"
  printf 'Q102_ACTIVATION_WRAPPER_ROLLBACK=%s\n' "$rollback_status"
  printf 'Q102_ACTIVATION_WRAPPER_AUDIT_LOG=%s\n' "$AUDIT_LOG"
  printf 'Q102_ACTIVATION_WRAPPER_END RC=%s\n' "$rc"
  exit "$rc"
}
trap finish EXIT

printf 'Q102_ACTIVATION_WRAPPER_BEGIN\n'
printf 'Q102_RUN_ID=%s\n' "$Q102_RUN_ID"
printf 'Q102_TARGET_HOST=%s\n' "$TARGET_HOST"
printf 'Q102_TARGET_IP=%s\n' "$TARGET_IP"
date --iso-8601=seconds

test "$(id -u)" -eq 0
test "$(hostname -s)" = "$TARGET_HOST"
ip -o -4 addr show scope global
ip -o -4 addr show scope global |
  awk '{print $4}' |
  cut -d/ -f1 |
  grep -Fxq "$TARGET_IP"
printf 'Q102_ACTIVATION_WRAPPER_IDENTITY=PASS\n'

test -x "$Q102_ENTRY"
test -f "$Q102_EVIDENCE_DIR/preflight.pass"
test ! -e "$Q102_EVIDENCE_DIR/execute.pass"
test ! -e "/var/backups/zhct-q102/files/${Q102_RUN_ID}"
printf 'Q102_ACTIVATION_WRAPPER_REPLAY_GATE=PASS\n'

common_env=(
  "Q102_RUN_ID=$Q102_RUN_ID"
  "Q102_REMOTE_LOCK_GRANTED=1"
  "Q102_REMOTE_LOCK_OWNER=NGINX_Q102"
  "Q102_SECRET_SOURCE_CONFIRMATION=Q101_NGINX01_CLONE_PRESERVED_CONFIRMED_BY_GLOBAL"
)

stage=execute
set +e
env "${common_env[@]}" "$Q102_ENTRY" execute
execute_rc=$?
set -e
printf 'Q102_ACTIVATION_EXECUTE_RC=%s\n' "$execute_rc"
if test "$execute_rc" -ne 0; then
  rollback_status=HANDLED_BY_Q102_EXECUTE_INTERNAL
  exit "$execute_rc"
fi
printf 'Q102_ACTIVATION_EXECUTE_GATE=PASS\n'

stage=verify
set +e
env "${common_env[@]}" "$Q102_ENTRY" verify
verify_rc=$?
set -e
printf 'Q102_ACTIVATION_VERIFY_RC=%s\n' "$verify_rc"
if test "$verify_rc" -ne 0; then
  stage=rollback_after_verify_failure
  set +e
  env \
    Q102_RUN_ID="$Q102_RUN_ID" \
    Q102_REMOTE_LOCK_GRANTED=1 \
    Q102_REMOTE_LOCK_OWNER=NGINX_Q102 \
    "$Q102_ENTRY" rollback
  rollback_rc=$?
  set -e
  if test "$rollback_rc" -eq 0; then
    rollback_status=PASS
  else
    rollback_status="FAIL_RC_${rollback_rc}"
  fi
  exit "$verify_rc"
fi
printf 'Q102_ACTIVATION_VERIFY_GATE=PASS\n'

stage=archive
env \
  Q102_RUN_ID="$Q102_RUN_ID" \
  Q102_REMOTE_LOCK_GRANTED=1 \
  Q102_REMOTE_LOCK_OWNER=NGINX_Q102 \
  "$Q102_ENTRY" archive
printf 'Q102_ACTIVATION_ARCHIVE_GATE=PASS\n'

stage=complete
printf 'Q102_ACTIVATION_WRAPPER_PASS\n'