#!/usr/bin/env bash
set -Eeuo pipefail

TASK="REDIS01_Q131_CONFIG_DIR_ACCESS_REPAIR_AND_RESUME_V2"
EXPECTED_HOST="sqjcredis01"
EXPECTED_IP="10.2.203.112"
V3_SCRIPT="/root/redis01-q131-selinux-label-repair-and-verify-v3.sh"
V3_SCRIPT_SHA256="214b361c44609d8de19b191c156d72486fdeede30cbe59691cf4e682f407f990"
FAILED_WRAPPER_AUDIT="/var/backups/zhct-q131-config-dir-repair/q131-config-dir-repair-20260803T092725Z/operator.log"
FAILED_WRAPPER_AUDIT_SHA256="d29d666e3a8ec74f868ef19ee4b80dee74ca797f52d0c2bfdbee8ec6dd97ba13"
RUN_ID="q131-config-dir-repair-v2-$(date -u +%Y%m%dT%H%M%SZ)"
EVIDENCE_DIR="/var/backups/zhct-q131-config-dir-repair-v2/${RUN_ID}"
AUDIT_LOG="${EVIDENCE_DIR}/operator.log"

timestamp() { date '+%Y-%m-%dT%H:%M:%S%z'; }

if test "${1:-}" = "--static-validate"; then
  echo "Q131_CONFIG_DIR_ACCESS_REPAIR_V2_STATIC_VALIDATE=PASS"
  echo "TARGET_HOST=${EXPECTED_HOST}"
  echo "TARGET_IP=${EXPECTED_IP}"
  echo "REPAIR=/etc/redis root:root:750 -> root:redis:750"
  echo "PRESTART_RUNUSER_PROBE=REMOVED_NON_AUTHORITATIVE"
  echo "RUNTIME_VALIDATION=V3_REAL_SERVICE_START_AND_Q131_VERIFY"
  echo "AUXILIARY_UNITS=DISABLED_INACTIVE"
  echo "Q132=LOCKED_NOT_EXECUTED"
  exit 0
fi

printf 'BEGIN|%s|%s\n' "$TASK" "$(timestamp)"

fail_before_write() {
  echo "ERROR: $*"
  printf 'END|%s|RC=1|PERSISTENT_WRITE=ZERO\n' "$TASK"
  exit 1
}

test "$(id -u)" -eq 0 || fail_before_write "root is required"
actual_host="$(hostname -s)"
test "$actual_host" = "$EXPECTED_HOST" ||
  fail_before_write "hostname mismatch: actual=${actual_host} expected=${EXPECTED_HOST}"
ip -4 -o addr show scope global | awk '{print $4}' | cut -d/ -f1 |
  grep -Fxq "$EXPECTED_IP" || fail_before_write "expected IPv4 is absent: ${EXPECTED_IP}"
echo "Q131_CONFIG_DIR_REPAIR_V2_TARGET_IDENTITY=PASS|host=${actual_host}|ip=${EXPECTED_IP}"

for command_name in sha256sum systemctl ss stat chgrp chmod; do
  command -v "$command_name" >/dev/null 2>&1 || fail_before_write "missing command: ${command_name}"
done
test -f "$V3_SCRIPT" && test ! -L "$V3_SCRIPT" || fail_before_write "v3 engine is absent or unsafe"
printf '%s  %s\n' "$V3_SCRIPT_SHA256" "$V3_SCRIPT" | sha256sum -c - ||
  fail_before_write "v3 engine checksum mismatch"
test -f "$FAILED_WRAPPER_AUDIT" && test ! -L "$FAILED_WRAPPER_AUDIT" ||
  fail_before_write "failed wrapper audit is absent or unsafe"
printf '%s  %s\n' "$FAILED_WRAPPER_AUDIT_SHA256" "$FAILED_WRAPPER_AUDIT" | sha256sum -c - ||
  fail_before_write "failed wrapper audit checksum mismatch"
grep -Fxq 'PRE_METADATA=root:root:750' "$FAILED_WRAPPER_AUDIT" ||
  fail_before_write "expected pre-metadata evidence is absent"
grep -Fxq 'Q131_CONFIG_DIR_REPAIR_ROLLBACK=ROOT_ROOT_0750_SAFE_QUIET' "$FAILED_WRAPPER_AUDIT" ||
  fail_before_write "safe rollback evidence is absent"

test -d /etc/redis && test ! -L /etc/redis || fail_before_write "/etc/redis is absent or unsafe"
test "$(stat -c '%U:%G:%a' /etc/redis)" = "root:root:750" ||
  fail_before_write "unexpected /etc/redis metadata"
for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
  test -f "$config" && test ! -L "$config" || fail_before_write "config is absent or unsafe: ${config}"
  test "$(stat -c '%U:%G:%a' "$config")" = "root:redis:640" ||
    fail_before_write "config metadata mismatch: ${config}"
done
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
  test "$(systemctl is-enabled "$unit" 2>/dev/null || true)" = "disabled" ||
    fail_before_write "safe quiet state requires disabled unit: ${unit}"
  test "$(systemctl is-active "$unit" 2>/dev/null || true)" = "inactive" ||
    fail_before_write "safe quiet state requires inactive unit: ${unit}"
done
if ss -lntupH | grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)' >/dev/null; then
  fail_before_write "target listener exists before repair"
fi
echo "Q131_CONFIG_DIR_REPAIR_V2_PREWRITE_GATE=PASS"

install -d -o root -g root -m 0700 "$EVIDENCE_DIR"
exec 3>&1 4>&2
exec >"$AUDIT_LOG" 2>&1

mutation_started=0
success=0

rollback_parent_metadata() {
  set +e
  systemctl disable --now redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service
  systemctl reset-failed redis5.service redis7.service
  chgrp root /etc/redis
  chmod 0750 /etc/redis
  echo "Q131_CONFIG_DIR_REPAIR_V2_ROLLBACK=ROOT_ROOT_0750_SAFE_QUIET"
  set -e
}

finalize() {
  local rc=$?
  trap - EXIT
  if test "$rc" -ne 0 && test "$mutation_started" -eq 1 && test "$success" -eq 0; then
    rollback_parent_metadata
  fi
  marker="$(test "$rc" -eq 0 && printf PASS_ROLE_ACTIVATED_LOCAL_ONLY || printf FAIL_ROLLED_BACK_SAFE_QUIET)"
  printf 'Q131_CONFIG_DIR_ACCESS_REPAIR_AND_RESUME_V2=%s\n' "$marker"
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG"
  printf 'Q131_CONFIG_DIR_ACCESS_REPAIR_AND_RESUME_V2=%s\n' "$marker" >&3
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG" >&3
}
trap finalize EXIT

echo "AUDIT_BEGIN|${TASK}|$(timestamp)"
echo "RUN_ID=${RUN_ID}"
echo "PRE_METADATA=$(stat -c '%U:%G:%a' /etc/redis)"
mutation_started=1
chgrp redis /etc/redis
echo "Q131_CONFIG_DIR_CHGRP=PASS|metadata=$(stat -c '%U:%G:%a' /etc/redis)"
chmod 0750 /etc/redis
echo "Q131_CONFIG_DIR_CHMOD=PASS|metadata=$(stat -c '%U:%G:%a' /etc/redis)"
test "$(stat -c '%U:%G:%a' /etc/redis)" = "root:redis:750"
echo "Q131_CONFIG_DIR_METADATA_ASSERT=PASS|metadata=root:redis:750"
echo "Q131_PRESTART_RUNUSER_PROBE=SKIPPED_NON_AUTHORITATIVE"

set +e
"$V3_SCRIPT"
v3_rc=$?
set -e
echo "Q131_V3_ENGINE_RC=${v3_rc}"
test "$v3_rc" -eq 0

success=1
echo "Q131_CONFIG_DIR_ACCESS_REPAIR_AND_RESUME_V2=PASS_ROLE_ACTIVATED_LOCAL_ONLY"
echo "Q132=LOCKED_NOT_EXECUTED"
echo "SENTINEL_HA=NOT_CONFIGURED"
echo "VIP=DISABLED"
echo "SECRET_VALUES=NOT_OUTPUT_NOT_HASHED"