#!/usr/bin/env bash
set -Eeuo pipefail

EXPECTED_HOSTNAME=sqjcDB01
EXPECTED_IP=10.2.208.106
ARCHIVE=/root/sanquan-mysql-q121-122-offline-package-v3-20260729.tar.gz
EXPECTED_ARCHIVE_SHA256=a7c7b581387163ce0aae3aea34823b41f00de4d1a7e1c0de9a6dae63d7c9ef9c
EXTRACT_DIR=/root/sanquan-mysql-q121-122-offline-package-v3-20260729-v4-run
RUN_ID="q121-manual-execute-v4-$(date '+%Y%m%dT%H%M%S%z')"
EVIDENCE_DIR="/var/backups/zhct-q121-122/$RUN_ID"
AUDIT_LOG="$EVIDENCE_DIR/manual-wrapper.log"
RESULT_FILE="$EVIDENCE_DIR/manual-wrapper-result.env"

umask 077
install -d -m 0700 -o root -g root "$EVIDENCE_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1

finish() {
  local rc=$?
  trap - EXIT
  {
    printf 'finished_at=%s\n' "$(date --iso-8601=seconds)"
    printf 'target_hostname=%s\n' "$EXPECTED_HOSTNAME"
    printf 'target_ip=%s\n' "$EXPECTED_IP"
    printf 'action=static_preflight_and_q121_execute\n'
    printf 'exit_code=%s\n' "$rc"
  } >"$RESULT_FILE"
  printf 'audit_log=%s\n' "$AUDIT_LOG"
  printf 'result_file=%s\n' "$RESULT_FILE"
  printf 'END MYSQL01_Q121_V4_VALIDATE_EXECUTE RC=%s\n' "$rc"
  exit "$rc"
}
trap finish EXIT

printf 'BEGIN MYSQL01_Q121_V4_VALIDATE_EXECUTE\n'
printf 'started_at=%s\n' "$(date --iso-8601=seconds)"
printf 'expected_hostname=%s\nexpected_ip=%s\n' "$EXPECTED_HOSTNAME" "$EXPECTED_IP"

[[ $EUID -eq 0 ]] || {
  echo 'ERROR: root is required'
  exit 1
}

actual_hostname=$(hostname -s)
[[ ${actual_hostname,,} == ${EXPECTED_HOSTNAME,,} ]] || {
  printf 'ERROR: hostname mismatch: expected=%s actual=%s\n' \
    "$EXPECTED_HOSTNAME" "$actual_hostname"
  exit 1
}

ip -o -4 addr show scope global | awk -v expected="$EXPECTED_IP" '
  {
    split($4, address, "/")
    if (address[1] == expected) found=1
  }
  END {exit !found}
' || {
  printf 'ERROR: expected global IPv4 is absent: %s\n' "$EXPECTED_IP"
  exit 1
}

[[ -f "$ARCHIVE" ]] || {
  echo 'ERROR: v3 archive is missing under /root'
  exit 1
}

actual_archive_sha256=$(sha256sum "$ARCHIVE" | awk '{print $1}')
[[ "$actual_archive_sha256" == "$EXPECTED_ARCHIVE_SHA256" ]] || {
  printf 'ERROR: archive SHA256 mismatch: expected=%s actual=%s\n' \
    "$EXPECTED_ARCHIVE_SHA256" "$actual_archive_sha256"
  exit 1
}
printf 'archive_sha256=%s\narchive_sha256_check=PASS\n' "$actual_archive_sha256"

[[ ! -e "$EXTRACT_DIR" ]] || {
  printf 'ERROR: extract target already exists: %s\n' "$EXTRACT_DIR"
  exit 1
}

install -d -m 0700 -o root -g root "$EXTRACT_DIR"
tar --extract --gzip --file="$ARCHIVE" --directory="$EXTRACT_DIR" --no-same-owner

cd "$EXTRACT_DIR"
sha256sum -c SHA256SUMS
bash -n q121-122-mysql.sh
bash q121-122-mysql.sh --static-validate
# q121 execute performs its own full preflight in the same evidence run.
# Do not create a separate timestamp-based preflight run immediately before it.
bash q121-122-mysql.sh q121 execute
printf 'MYSQL01_Q121_V4_VALIDATE_EXECUTE_PASS\n'