#!/usr/bin/env bash
set -Eeuo pipefail

EXPECTED_HOSTNAME=sqjcDB02
EXPECTED_IP=10.2.208.107
SOURCE_Q121_RUN=q121-20260729T185007+0800
PRIMARY_IDENTITY=/root/q121-primary-identity.env
EXPECTED_PRIMARY_IDENTITY_SHA256=d4f5b267cdc2e279aed60eb79442e01e7e08d479710c705e11c90bf14af20a31
ARCHIVE=/root/sanquan-mysql-q121-122-offline-package-v5-20260729.tar.gz
EXPECTED_ARCHIVE_SHA256=5cafeffebe365fe7753c9a9b6d6f2380b53ce33d7d5ce8be0c12a8134f6f709b
EXTRACT_DIR=/root/sanquan-mysql-q121-122-offline-package-v5-20260729-q122-run

identity_matches() {
  local actual_hostname=$1 ipv4_lines=$2
  local actual_lower expected_lower
  actual_lower=$(printf '%s' "$actual_hostname" | tr '[:upper:]' '[:lower:]')
  expected_lower=$(printf '%s' "$EXPECTED_HOSTNAME" | tr '[:upper:]' '[:lower:]')
  [[ "$actual_lower" == "$expected_lower" ]] || return 1
  awk -v expected="$EXPECTED_IP" '
    {
      address=$0
      sub(/\/.*/, "", address)
      if (address == expected) found=1
    }
    END {exit !found}
  ' <<<"$ipv4_lines"
}

if [[ ${1:-} == --self-test-wrong-host ]]; then
  if identity_matches wrong-host "$EXPECTED_IP"; then
    echo "ERROR: wrong-host negative gate unexpectedly passed"
    exit 1
  fi
  echo "Q122_V5_WRONG_HOST_NEGATIVE_TEST_PASS"
  exit 0
fi

[[ $# -eq 0 ]] || {
  echo "ERROR: this wrapper accepts no arguments"
  exit 2
}

[[ $EUID -eq 0 ]] || {
  echo "ERROR: root is required"
  exit 1
}

actual_hostname=$(hostname -s)
actual_ipv4=$(ip -o -4 addr show scope global | awk '{print $4}')
identity_matches "$actual_hostname" "$actual_ipv4" || {
  printf 'ERROR: target identity mismatch: expected_hostname=%s expected_ip=%s actual_hostname=%s\n' \
    "$EXPECTED_HOSTNAME" "$EXPECTED_IP" "$actual_hostname"
  exit 1
}

RUN_ID="q122-v5-execute-$(date '+%Y%m%dT%H%M%S%z')"
EVIDENCE_DIR="/var/backups/zhct-q121-122/$RUN_ID"
AUDIT_LOG="$EVIDENCE_DIR/manual-wrapper.log"
RESULT_FILE="$EVIDENCE_DIR/manual-wrapper-result.env"
umask 077
install -d -m 0700 -o root -g root "$EVIDENCE_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1

finish() {
  local rc=$?
  trap - EXIT
  {
    printf 'finished_at=%s\n' "$(date --iso-8601=seconds)"
    printf 'target_hostname=%s\n' "$EXPECTED_HOSTNAME"
    printf 'target_ip=%s\n' "$EXPECTED_IP"
    printf 'source_q121_run=%s\n' "$SOURCE_Q121_RUN"
    printf 'action=q122_v5_initialize_activate_verify\n'
    printf 'replication=NOT_PERFORMED_Q221_GATE\n'
    printf 'business_sql=NOT_PERFORMED_Q261_GATE\n'
    printf 'exit_code=%s\n' "$rc"
  } >"$RESULT_FILE"
  printf 'audit_log=%s\n' "$AUDIT_LOG"
  printf 'result_file=%s\n' "$RESULT_FILE"
  printf 'END MYSQL02_Q122_V5_EXECUTE RC=%s\n' "$rc"
  exit "$rc"
}
trap finish EXIT

printf 'BEGIN MYSQL02_Q122_V5_EXECUTE\n'
printf 'started_at=%s\n' "$(date --iso-8601=seconds)"
printf 'target_identity=PASS\n'
printf 'expected_hostname=%s\nexpected_ip=%s\n' "$EXPECTED_HOSTNAME" "$EXPECTED_IP"
printf 'source_q121_run=%s\n' "$SOURCE_Q121_RUN"

[[ -f "$PRIMARY_IDENTITY" && ! -L "$PRIMARY_IDENTITY" ]] || {
  echo "ERROR: Q-121 primary identity receipt is missing or is a symlink"
  exit 1
}
actual_identity_sha256=$(sha256sum "$PRIMARY_IDENTITY" | awk '{print $1}')
[[ "$actual_identity_sha256" == "$EXPECTED_PRIMARY_IDENTITY_SHA256" ]] || {
  printf 'ERROR: Q-121 identity SHA256 mismatch: expected=%s actual=%s\n' \
    "$EXPECTED_PRIMARY_IDENTITY_SHA256" "$actual_identity_sha256"
  exit 1
}
awk -F= '
  $1=="mysql56_server_id" && $2 ~ /^[0-9]+$/ {a++}
  $1=="mysql56_server_uuid" && $2 ~ /^[0-9a-fA-F-]{36}$/ {b++}
  $1=="mysql80_server_id" && $2 ~ /^[0-9]+$/ {c++}
  $1=="mysql80_server_uuid" && $2 ~ /^[0-9a-fA-F-]{36}$/ {d++}
  END {exit !(NR==4 && a==1 && b==1 && c==1 && d==1)}
' "$PRIMARY_IDENTITY" || {
  echo "ERROR: Q-121 identity receipt structure is invalid"
  exit 1
}
stat -c 'before mode=%a owner=%U:%G bytes=%s path=%n' "$PRIMARY_IDENTITY" \
  >"$EVIDENCE_DIR/q121-primary-identity-metadata-before.txt"
chown root:root "$PRIMARY_IDENTITY"
chmod 0600 "$PRIMARY_IDENTITY"
[[ $(stat -c '%a %U:%G' "$PRIMARY_IDENTITY") == '600 root:root' ]] || {
  echo "ERROR: Q-121 identity receipt metadata normalization failed"
  exit 1
}
[[ $(sha256sum "$PRIMARY_IDENTITY" | awk '{print $1}') == "$EXPECTED_PRIMARY_IDENTITY_SHA256" ]] || {
  echo "ERROR: Q-121 identity receipt changed during metadata normalization"
  exit 1
}
stat -c 'after mode=%a owner=%U:%G bytes=%s path=%n' "$PRIMARY_IDENTITY" \
  >"$EVIDENCE_DIR/q121-primary-identity-metadata-after.txt"
printf 'q121_primary_identity_receipt=PASS\n'
printf 'q121_primary_identity_sha256=%s\n' "$actual_identity_sha256"

[[ -f "$ARCHIVE" ]] || {
  echo "ERROR: v5 Q-121/Q-122 archive is missing"
  exit 1
}
actual_archive_sha256=$(sha256sum "$ARCHIVE" | awk '{print $1}')
[[ "$actual_archive_sha256" == "$EXPECTED_ARCHIVE_SHA256" ]] || {
  printf 'ERROR: archive SHA256 mismatch: expected=%s actual=%s\n' \
    "$EXPECTED_ARCHIVE_SHA256" "$actual_archive_sha256"
  exit 1
}
printf 'archive_sha256=%s\narchive_sha256_check=PASS\n' "$actual_archive_sha256"

[[ ! -e "$EXTRACT_DIR" ]] || {
  printf 'ERROR: extract target already exists: %s\n' "$EXTRACT_DIR"
  exit 1
}
install -d -m 0700 -o root -g root "$EXTRACT_DIR"
tar --extract --gzip --file="$ARCHIVE" --directory="$EXTRACT_DIR" --no-same-owner

cd "$EXTRACT_DIR"
sha256sum -c SHA256SUMS
bash -n q121-122-mysql.sh
bash -n framework/common/lib/runtime.sh
bash -n framework/roles/mysql/hooks.sh
bash q121-122-mysql.sh --static-validate
bash q121-122-mysql.sh --self-test-schema-contract
printf 'q122_v5_package_gate=PASS\n'

bash q121-122-mysql.sh q122 execute

[[ $(sha256sum "$PRIMARY_IDENTITY" | awk '{print $1}') == "$EXPECTED_PRIMARY_IDENTITY_SHA256" ]] || {
  echo "ERROR: Q-121 identity receipt changed after Q-122 execute"
  exit 1
}
printf 'MYSQL02_Q122_V5_EXECUTE_PASS\n'