#!/usr/bin/env bash

set -Eeuo pipefail

[[ $# -eq 2 ]] || {
    echo "Usage: $0 <q110|q111|q112> <run_id>" >&2
    exit 2
}
QID=$1
RUN_ID=$2
case "$QID" in q110|q111|q112) ;; *) exit 2 ;; esac
[[ "$RUN_ID" =~ ^${QID}-[A-Za-z0-9+_.:-]+$ ]] || {
    echo "ERROR: run_id must begin with ${QID}-" >&2
    exit 2
}
[[ $(id -u) -eq 0 ]] || { echo 'ERROR: root required' >&2; exit 1; }

ROOT="/var/backups/zhct-${QID}"
SOURCE="$ROOT/evidence/$RUN_ID"
ARCHIVE_DIR="$ROOT/archives"
ARCHIVE="$ARCHIVE_DIR/${RUN_ID}.tar.gz"
SHA_FILE="${ARCHIVE}.sha256"

[[ -d "$SOURCE" && ! -L "$SOURCE" ]]
[[ -f "$SOURCE/result.env" && ! -L "$SOURCE/result.env" ]]
grep -Fxq "run_id=$RUN_ID" "$SOURCE/result.env"
grep -Eq '^result=(PASS|FAIL)$' "$SOURCE/result.env"
[[ ! -e "$ARCHIVE" && ! -L "$ARCHIVE" ]]
[[ ! -e "$SHA_FILE" && ! -L "$SHA_FILE" ]]

install -d -m 0700 -o root -g root "$ARCHIVE_DIR"
members=("$RUN_ID")
if [[ -d "$ROOT/evidence/${RUN_ID}-verify" && ! -L "$ROOT/evidence/${RUN_ID}-verify" ]]; then
    grep -Fxq "run_id=${RUN_ID}-verify" "$ROOT/evidence/${RUN_ID}-verify/result.env"
    members+=("${RUN_ID}-verify")
fi
tar --sort=name --mtime='@0' --owner=0 --group=0 --numeric-owner \
    -C "$ROOT/evidence" -cf - "${members[@]}" | gzip -n >"$ARCHIVE"
chmod 0600 "$ARCHIVE"
(
    cd "$ARCHIVE_DIR"
    sha256sum "$(basename "$ARCHIVE")" >"$(basename "$SHA_FILE")"
    sha256sum -c "$(basename "$SHA_FILE")"
)
chmod 0600 "$SHA_FILE"

echo APP_EVIDENCE_ARCHIVE_RESULT=PASS
echo "APP_EVIDENCE_ARCHIVE=$ARCHIVE"
echo "APP_EVIDENCE_ARCHIVE_SHA256_FILE=$SHA_FILE"