#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

EXPECTED_HOST=sqjcapp02
EXPECTED_IP=10.2.203.105
GATE_DIR=/root/sanquan-app-q110-112-gates
AUDIT_ROOT=/var/log/zhct-manual-q110-112
Q102_RUN=q102-manual-20260729T071640Z
SFTP_EVIDENCE_SHA256=f040bfa9890b64602e0d2180f6e19ff879303287b97352b07173a2ba38c5d9f5
RESULT=FAIL
ROLLBACK_STATE=NOT_REQUIRED
AUDIT_LOG=NOT_CREATED
CREATED_FILES=()
CREATED_DIR=0
TEMP_FILE=

finish() {
    rc=$?
    trap - EXIT
    if [ "$rc" -ne 0 ]; then
        for file in "${CREATED_FILES[@]}"; do
            rm -f -- "$file"
        done
        if [ -n "$TEMP_FILE" ]; then
            rm -f -- "$TEMP_FILE"
        fi
        if [ "$CREATED_DIR" -eq 1 ]; then
            rmdir -- "$GATE_DIR" 2>/dev/null || true
        fi
        ROLLBACK_STATE=CREATED_GATE_FILES_REMOVED
    fi
    printf 'Q110_GATE_AUTH_AUDIT_LOG=%s\n' "$AUDIT_LOG"
    printf 'Q110_GATE_AUTH_RC=%s\n' "$rc"
    printf 'Q110_GATE_AUTH_RESULT=%s\n' "$RESULT"
    printf 'Q110_GATE_AUTH_ROLLBACK_STATE=%s\n' "$ROLLBACK_STATE"
    printf 'Q110_GATE_AUTH_STAGE2=NOT_PERFORMED\n'
    printf 'Q110_GATE_AUTH_POST_CLONE=NOT_PERFORMED\n'
    printf 'Q110_GATE_AUTH_ACTIVATE=NOT_PERFORMED\n'
    printf 'Q110_GATE_AUTH_SERVICE_CHANGE=NONE\n'
    printf 'Q110_GATE_AUTH_END\n'
    exit "$rc"
}
trap finish EXIT

verify_gate() {
    file=$1
    test -f "$file"
    test ! -L "$file"
    test "$(stat -c '%U:%G' "$file")" = root:root
    test "$(stat -c '%a' "$file")" = 400
    test "$(tr -d '\r\n' <"$file")" = PASS
}

printf 'Q110_GATE_AUTH_BEGIN\n'
date '+%Y-%m-%dT%H:%M:%S%z'
printf 'EXPECTED_HOST=%s EXPECTED_IP=%s\n' "$EXPECTED_HOST" "$EXPECTED_IP"

actual_host=$(hostname -s)
actual_ipv4=$(ip -o -4 addr show scope global)
printf 'ACTUAL_HOST=%s\n' "$actual_host"
printf '%s\n' "$actual_ipv4"
test "$actual_host" = "$EXPECTED_HOST"
grep -Eq '(^|[[:space:]])10\.2\.203\.105/' <<<"$actual_ipv4"

install -d -m 0700 -o root -g root "$AUDIT_ROOT"
run_id="q110-app02-gate-auth-$(date '+%Y%m%dT%H%M%S%z')"
AUDIT_LOG="$AUDIT_ROOT/${run_id}.log"
touch "$AUDIT_LOG"
chmod 0600 "$AUDIT_LOG"
exec > >(tee -a "$AUDIT_LOG") 2>&1

printf 'Q110_GATE_AUTH_RUN_ID=%s\n' "$run_id"
printf 'Q110_GATE_AUTH_TARGET=%s/%s\n' "$EXPECTED_HOST" "$EXPECTED_IP"
printf 'Q110_GATE_AUTH_Q102_RUN=%s\n' "$Q102_RUN"
printf 'Q110_GATE_AUTH_SFTP_EVIDENCE_SHA256=%s\n' "$SFTP_EVIDENCE_SHA256"

for name in Q-102 APP02_ASSET_MAPPING; do
    file="$GATE_DIR/${name}.pass"
    if [ -e "$file" ] || [ -L "$file" ]; then
        printf 'ERROR: gate target already exists: %s\n' "$file" >&2
        exit 41
    fi
done

if [ -e "$GATE_DIR" ] || [ -L "$GATE_DIR" ]; then
    test -d "$GATE_DIR"
    test ! -L "$GATE_DIR"
    test "$(stat -c '%U:%G' "$GATE_DIR")" = root:root
    test "$(stat -c '%a' "$GATE_DIR")" = 700
else
    install -d -m 0700 -o root -g root "$GATE_DIR"
    CREATED_DIR=1
fi

TEMP_FILE=$(mktemp "$GATE_DIR/.q110-gate.XXXXXX")
printf 'PASS\n' >"$TEMP_FILE"
chmod 0400 "$TEMP_FILE"
chown root:root "$TEMP_FILE"

for name in Q-102 APP02_ASSET_MAPPING; do
    file="$GATE_DIR/${name}.pass"
    install -m 0400 -o root -g root "$TEMP_FILE" "$file"
    CREATED_FILES+=("$file")
done

rm -f -- "$TEMP_FILE"
TEMP_FILE=

verify_gate "$GATE_DIR/Q-102.pass"
verify_gate "$GATE_DIR/APP02_ASSET_MAPPING.pass"

printf 'Q110_GATE_AUTH_Q102=PASS\n'
printf 'Q110_GATE_AUTH_APP02_ASSET_MAPPING=PASS\n'
RESULT=PASS