#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly EXPECTED_HOST=sqjcredis01
readonly EXPECTED_IP=10.2.203.112
readonly EXPECTED_LOCK_OWNER=REDIS_Q131_SECRET_IMPORT
readonly EXPECTED_SOURCE_HOST=sqjcnginx01
readonly EXPECTED_SOURCE_IP=10.2.203.102
readonly EXPECTED_SOURCE_CONTRACT=Q101_NGINX01_CANONICAL
readonly EXPECTED_SOURCE_STAGING=/root/q131-secret-transfer/redis-from-nginx01
readonly STAGING_DIR=/root/q131-secret-import/from-nginx01
readonly RECEIPT="${STAGING_DIR}/SOURCE_RECEIPT.txt"
readonly TARGET_DIR=/etc/zhct/secrets
readonly TARGET5="${TARGET_DIR}/redis5.password"
readonly TARGET7="${TARGET_DIR}/redis7.password"
readonly READINESS=/root/redis01-q131-execute-readiness.sh
readonly READINESS_SHA=45e0c77cfd949b378a096f9824e6a94d3c71a61069327fd4ee20f81ddc3b16c6
readonly AUDIT_ROOT=/var/backups/zhct-q131-secret-import
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"

MODE="${1:---static-validate}"
RUN_ID="${Q131_SECRET_IMPORT_RUN_ID:-q131-secret-import-$(date -u +%Y%m%dT%H%M%SZ)}"
AUDIT_DIR="${AUDIT_ROOT}/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"
tmp5=
tmp7=
target5_written=0
target7_written=0
target_dir_created=0
success=0

finish() {
    local rc=$?
    trap - EXIT
    set +e
    test -n "$tmp5" && rm -f -- "$tmp5"
    test -n "$tmp7" && rm -f -- "$tmp7"
    if test "$rc" -ne 0 && test "$MODE" = import; then
        test "$target5_written" -eq 1 && rm -f -- "$TARGET5"
        test "$target7_written" -eq 1 && rm -f -- "$TARGET7"
        if test "$target_dir_created" -eq 1; then
            rmdir -- "$TARGET_DIR" 2>/dev/null || true
        fi
        if test "$target5_written" -eq 1 || test "$target7_written" -eq 1; then
            printf 'Q131_SECRET_IMPORT_ROLLBACK=THIS_RUN_TARGETS_REMOVED_STAGING_RETAINED\n'
        else
            printf 'Q131_SECRET_IMPORT_ROLLBACK=NO_TARGET_FILE_WRITTEN_STAGING_RETAINED\n'
        fi
    elif test "$rc" -ne 0; then
        printf 'Q131_SECRET_IMPORT_ROLLBACK=NOT_REQUIRED_NO_TARGET_WRITE_STAGING_RETAINED\n'
    elif test "$success" -eq 1; then
        printf 'Q131_SECRET_IMPORT_ROLLBACK=NOT_REQUIRED\n'
    else
        printf 'Q131_SECRET_IMPORT_ROLLBACK=NOT_REQUIRED_NO_TARGET_WRITE\n'
    fi
    printf 'Q131_SECRET_IMPORT_END MODE=%s RC=%s\n' "$MODE" "$rc"
    exit "$rc"
}
trap finish EXIT

identity_values_gate() {
    local actual_host=$1 ip_lines=$2
    test "$actual_host" = "$EXPECTED_HOST" &&
        grep -Eq "(^|[[:space:]])${EXPECTED_IP}/" <<<"$ip_lines"
}

lock_values_gate() {
    local granted=$1 owner=$2 contract=$3
    test "$granted" = 1 &&
        test "$owner" = "$EXPECTED_LOCK_OWNER" &&
        test "$contract" = "$EXPECTED_SOURCE_CONTRACT"
}

root_gate() {
    test "$EUID" -eq 0
    echo 'Q131_IMPORT_ROOT_GATE=PASS'
}

run_id_gate() {
    [[ "$RUN_ID" =~ ^q131-secret-import-[A-Za-z0-9._-]+$ ]]
    echo 'Q131_IMPORT_RUN_ID_GATE=PASS'
}

identity_gate() {
    local actual_host ip_lines
    actual_host=$(hostname -s)
    ip_lines=$(ip -o -4 addr show)
    printf 'Q131_TARGET_HOST=%s\n' "$actual_host"
    printf '%s\n' "$ip_lines"
    identity_values_gate "$actual_host" "$ip_lines"
    echo 'Q131_TARGET_IDENTITY=PASS'
}

lock_gate() {
    lock_values_gate \
        "${Q131_REMOTE_LOCK_GRANTED:-}" \
        "${Q131_REMOTE_LOCK_OWNER:-}" \
        "${Q131_SECRET_SOURCE_CONTRACT:-}"
    echo 'Q131_REMOTE_LOCK_GATE=PASS'
    printf 'Q131_SOURCE_CONTRACT=%s\n' "$EXPECTED_SOURCE_CONTRACT"
}

pre_mutation_gate() {
    run_id_gate
    root_gate
    identity_gate
    lock_gate
    echo 'Q131_PRE_MUTATION_GATE=PASS'
}

safe_stat() {
    stat -c 'TYPE=%F MODE=%a OWNER=%U:%G SIZE=%s' -- "$1"
}

validate_secret_file() {
    local file=$1 mode owner
    test -f "$file"
    test ! -L "$file"
    owner=$(stat -c %U:%G -- "$file")
    mode=$(stat -c %a -- "$file")
    test "$owner" = root:root
    test "$mode" = 600
    test -s "$file"
    awk 'NR != 1 || length($0) == 0 {bad=1} END {exit (bad || NR != 1)}' "$file"
}

receipt_contract_lines_gate() {
    local receipt=$1 staging=$2 size5 size7 expected5 expected7
    test "$(awk 'END {print NR+0}' "$receipt")" -eq 10
    grep -Fxq 'Q131_SOURCE_RECEIPT_VERSION=1' "$receipt"
    grep -Eq '^RUN_ID=q131-secret-export-[A-Za-z0-9._-]+$' "$receipt"
    grep -Eq '^CREATED_AT=[^[:space:]]+$' "$receipt"
    grep -Fxq "SOURCE_HOST=$EXPECTED_SOURCE_HOST" "$receipt"
    grep -Fxq "SOURCE_IP=$EXPECTED_SOURCE_IP" "$receipt"
    grep -Fxq "SOURCE_CONTRACT=$EXPECTED_SOURCE_CONTRACT" "$receipt"
    grep -Fxq 'SECRET_VALUES=NOT_OUTPUT_NOT_LOGGED' "$receipt"
    grep -Fxq 'SECRET_CONTENT_SHA=NOT_CALCULATED' "$receipt"
    test "$(grep -c '^TRANSFER_FILE=' "$receipt")" -eq 2

    size5=$(wc -c <"$staging/redis5.password")
    size7=$(wc -c <"$staging/redis7.password")
    expected5="TRANSFER_FILE=redis5.password SOURCE=/etc/zhct/secrets/redis5.password STAGED=${EXPECTED_SOURCE_STAGING}/redis5.password OWNER=root:root MODE=600 SIZE=${size5}"
    expected7="TRANSFER_FILE=redis7.password SOURCE=/etc/zhct/secrets/redis7.password STAGED=${EXPECTED_SOURCE_STAGING}/redis7.password OWNER=root:root MODE=600 SIZE=${size7}"
    grep -Fxq "$expected5" "$receipt"
    grep -Fxq "$expected7" "$receipt"
}

validate_receipt() {
    test -f "$RECEIPT"
    test ! -L "$RECEIPT"
    test "$(stat -c %U:%G -- "$RECEIPT")" = root:root
    test "$(stat -c %a -- "$RECEIPT")" = 600
    receipt_contract_lines_gate "$RECEIPT" "$STAGING_DIR"
}

validate_staging() {
    test -d "$STAGING_DIR"
    test ! -L "$STAGING_DIR"
    test "$(stat -c %U:%G -- "$STAGING_DIR")" = root:root
    test "$(stat -c %a -- "$STAGING_DIR")" = 700
    validate_secret_file "$STAGING_DIR/redis5.password"
    validate_secret_file "$STAGING_DIR/redis7.password"
    validate_receipt
    printf 'STAGING_FILE=redis5.password %s LINE_POLICY=ONE_NONEMPTY_LINE\n' \
        "$(safe_stat "$STAGING_DIR/redis5.password")"
    printf 'STAGING_FILE=redis7.password %s LINE_POLICY=ONE_NONEMPTY_LINE\n' \
        "$(safe_stat "$STAGING_DIR/redis7.password")"
    printf 'SOURCE_RECEIPT=%s %s CONTRACT_V1=PASS PATH_SIZE_MATCH=PASS\n' \
        "$RECEIPT" "$(safe_stat "$RECEIPT")"
    echo 'Q131_IMPORT_STAGING_GATE=PASS'
}

validate_targets_absent() {
    test ! -e "$TARGET5"
    test ! -L "$TARGET5"
    test ! -e "$TARGET7"
    test ! -L "$TARGET7"
    echo 'Q131_IMPORT_TARGETS_ABSENT=PASS'
}

validate_target_dir_state() {
    if test -e "$TARGET_DIR" || test -L "$TARGET_DIR"; then
        test -d "$TARGET_DIR"
        test ! -L "$TARGET_DIR"
        test "$(stat -c %U:%G -- "$TARGET_DIR")" = root:root
        test "$(stat -c %a -- "$TARGET_DIR")" = 700
        echo 'Q131_IMPORT_TARGET_DIR=EXISTING_ROOT_ROOT_0700'
    else
        echo 'Q131_IMPORT_TARGET_DIR=ABSENT_WILL_CREATE_0700'
    fi
}

static_validate() {
    local scratch fixture receipt5_size receipt7_size gate_line write_line
    echo 'Q131_SECRET_IMPORT_BEGIN MODE=--static-validate'
    bash -n "$SCRIPT_PATH"
    test "$EXPECTED_HOST" = sqjcredis01
    test "$EXPECTED_IP" = 10.2.203.112
    test "$STAGING_DIR" = /root/q131-secret-import/from-nginx01
    test "$EXPECTED_SOURCE_CONTRACT" = Q101_NGINX01_CANONICAL
    scratch=$(mktemp -d)
    if identity_values_gate wrong-host "${EXPECTED_IP}/24"; then
        rmdir "$scratch"
        echo 'Q131_WRONG_HOST_NEGATIVE_TEST=FAIL'
        return 1
    fi
    test -z "$(find "$scratch" -mindepth 1 -print -quit)"
    rmdir "$scratch"
    echo 'Q131_WRONG_HOST_ZERO_WRITE_TEST=PASS'
    if lock_values_gate 1 wrong-owner "$EXPECTED_SOURCE_CONTRACT"; then
        echo 'Q131_WRONG_LOCK_NEGATIVE_TEST=FAIL'
        return 1
    fi
    echo 'Q131_WRONG_LOCK_ZERO_WRITE_TEST=PASS'
    gate_line=$(awk '/^import_secrets\(\)/ {inside=1} inside && /pre_mutation_gate/ {print NR; exit}' "$SCRIPT_PATH")
    write_line=$(awk '/^import_secrets\(\)/ {inside=1} inside && /install -d -m 0700 -o root -g root -- "\$AUDIT_ROOT"/ {print NR; exit}' "$SCRIPT_PATH")
    test -n "$gate_line"
    test -n "$write_line"
    test "$gate_line" -lt "$write_line"
    echo 'Q131_PRE_MUTATION_ORDER=PASS'
    fixture=$(mktemp -d)
    printf 'fixture-redis5\n' >"$fixture/redis5.password"
    printf 'fixture-redis7-value\n' >"$fixture/redis7.password"
    receipt5_size=$(wc -c <"$fixture/redis5.password")
    receipt7_size=$(wc -c <"$fixture/redis7.password")
    {
        printf 'Q131_SOURCE_RECEIPT_VERSION=1\n'
        printf 'RUN_ID=q131-secret-export-static-fixture\n'
        printf 'CREATED_AT=2026-07-29T00:00:00+08:00\n'
        printf 'SOURCE_HOST=%s\n' "$EXPECTED_SOURCE_HOST"
        printf 'SOURCE_IP=%s\n' "$EXPECTED_SOURCE_IP"
        printf 'SOURCE_CONTRACT=%s\n' "$EXPECTED_SOURCE_CONTRACT"
        printf 'TRANSFER_FILE=redis5.password SOURCE=/etc/zhct/secrets/redis5.password STAGED=%s/redis5.password OWNER=root:root MODE=600 SIZE=%s\n' \
            "$EXPECTED_SOURCE_STAGING" "$receipt5_size"
        printf 'TRANSFER_FILE=redis7.password SOURCE=/etc/zhct/secrets/redis7.password STAGED=%s/redis7.password OWNER=root:root MODE=600 SIZE=%s\n' \
            "$EXPECTED_SOURCE_STAGING" "$receipt7_size"
        printf 'SECRET_VALUES=NOT_OUTPUT_NOT_LOGGED\n'
        printf 'SECRET_CONTENT_SHA=NOT_CALCULATED\n'
    } >"$fixture/SOURCE_RECEIPT.txt"
    receipt_contract_lines_gate "$fixture/SOURCE_RECEIPT.txt" "$fixture"
    rm -rf -- "$fixture"
    echo 'Q131_SOURCE_RECEIPT_V1_FIXTURE_TEST=PASS'
    echo 'Q131_SECRET_VALUE_OUTPUT=PROHIBITED'
    echo 'Q131_SECRET_CONTENT_SHA=PROHIBITED'
    echo 'Q131_SECRET_IMPORT_STATIC_VALIDATE=PASS'
}

import_secrets() {
    echo 'Q131_SECRET_IMPORT_BEGIN MODE=import'
    pre_mutation_gate
    validate_staging
    validate_target_dir_state
    validate_targets_absent
    test -x "$READINESS"
    printf '%s  %s\n' "$READINESS_SHA" "$READINESS" | sha256sum -c -

    install -d -m 0700 -o root -g root -- "$AUDIT_ROOT" "$AUDIT_DIR"
    exec > >(tee -a "$AUDIT_LOG") 2>&1
    printf 'AUDIT_BEGIN|Q131_SECRET_IMPORT|%s\n' "$(date --iso-8601=seconds)"
    {
        printf 'target\tstate_before\n'
        printf '%s\tABSENT\n' "$TARGET5"
        printf '%s\tABSENT\n' "$TARGET7"
        printf 'source_receipt\t%s\n' "$RECEIPT"
        printf 'source_contract\t%s\n' "$EXPECTED_SOURCE_CONTRACT"
    } >"$AUDIT_DIR/target-state-before.tsv"
    chmod 0600 "$AUDIT_DIR/target-state-before.tsv"

    if test ! -d "$TARGET_DIR"; then
        install -d -m 0700 -o root -g root -- "$TARGET_DIR"
        target_dir_created=1
    else
        validate_target_dir_state
    fi

    tmp5=$(mktemp "$TARGET_DIR/.redis5.password.XXXXXX")
    tmp7=$(mktemp "$TARGET_DIR/.redis7.password.XXXXXX")
    install -m 0600 -o root -g root -- "$STAGING_DIR/redis5.password" "$tmp5"
    install -m 0600 -o root -g root -- "$STAGING_DIR/redis7.password" "$tmp7"
    validate_secret_file "$tmp5"
    validate_secret_file "$tmp7"

    mv -- "$tmp5" "$TARGET5"
    tmp5=
    target5_written=1
    mv -- "$tmp7" "$TARGET7"
    tmp7=
    target7_written=1

    validate_secret_file "$TARGET5"
    validate_secret_file "$TARGET7"
    cmp -s -- "$STAGING_DIR/redis5.password" "$TARGET5"
    cmp -s -- "$STAGING_DIR/redis7.password" "$TARGET7"
    printf 'TARGET_FILE=redis5.password %s COPY_MATCH=PASS\n' "$(safe_stat "$TARGET5")"
    printf 'TARGET_FILE=redis7.password %s COPY_MATCH=PASS\n' "$(safe_stat "$TARGET7")"
    echo 'SECRET_VALUES=NOT_OUTPUT_NOT_LOGGED'
    echo 'SECRET_CONTENT_SHA=NOT_CALCULATED'
    echo 'Q131_SECRET_IMPORT_METADATA=PASS'

    "$READINESS"
    echo 'Q131_POST_IMPORT_READINESS_RERUN=PASS'
    echo "Q131_IMPORT_STAGING_RETAINED=$STAGING_DIR"
    echo 'POST_CLONE=NOT_PERFORMED'
    echo 'ACTIVATION=NOT_PERFORMED'
    success=1
    echo 'Q131_CANONICAL_SECRET_IMPORT=PASS'
}

case "$MODE" in
    --static-validate)
        static_validate
        ;;
    import)
        import_secrets
        ;;
    *)
        printf 'Usage: %s --static-validate|import\n' "$SCRIPT_PATH" >&2
        exit 64
        ;;
esac