#!/usr/bin/env bash
set -Eeuo pipefail

TASK="REDIS01_Q131_INSTALL_SEMANAGE_AND_RUN_REPAIR"
EXPECTED_HOST="sqjcredis01"
EXPECTED_IP="10.2.203.112"
REPAIR_SCRIPT="/root/redis01-q131-selinux-label-repair-and-verify.sh"
REPAIR_SCRIPT_SHA256="d2ac160a5c7c3b0836718e8b3a08aeac7f4cddbe0f580aacfee38333dea5766a"
PACKAGE_NAME="policycoreutils-python-utils"
RUN_ID="q131-semanage-install-$(date -u +%Y%m%dT%H%M%SZ)"
EVIDENCE_DIR="/var/backups/zhct-q131-semanage-install/${RUN_ID}"
AUDIT_LOG="${EVIDENCE_DIR}/operator.log"
RESULT_FILE="${EVIDENCE_DIR}/result.env"

timestamp() {
  date '+%Y-%m-%dT%H:%M:%S%z'
}

if test "${1:-}" = "--static-validate"; then
  echo "Q131_SEMANAGE_INSTALL_LAUNCHER_STATIC_VALIDATE=PASS"
  echo "TARGET_HOST=${EXPECTED_HOST}"
  echo "TARGET_IP=${EXPECTED_IP}"
  echo "PACKAGE=${PACKAGE_NAME}"
  echo "DNF_GPGCHECK=BYPASS_PROHIBITED"
  echo "REPAIR_SCRIPT_SHA256=${REPAIR_SCRIPT_SHA256}"
  echo "Q132=LOCKED_NOT_EXECUTED"
  exit 0
fi

printf 'BEGIN|%s|%s\n' "$TASK" "$(timestamp)"

fail_before_write() {
  echo "ERROR: $*"
  printf 'END|%s|RC=1|PERSISTENT_WRITE=ZERO\n' "$TASK"
  exit 1
}

test "$(id -u)" -eq 0 || fail_before_write "root is required"
actual_host="$(hostname -s)"
test "$actual_host" = "$EXPECTED_HOST" ||
  fail_before_write "hostname mismatch: actual=${actual_host} expected=${EXPECTED_HOST}"
ip -4 -o addr show scope global | awk '{print $4}' | cut -d/ -f1 |
  grep -Fxq "$EXPECTED_IP" ||
  fail_before_write "expected IPv4 is absent: ${EXPECTED_IP}"

echo "Q131_SEMANAGE_INSTALL_TARGET_IDENTITY=PASS|host=${actual_host}|ip=${EXPECTED_IP}"

for command_name in dnf rpm sha256sum systemctl ss; do
  command -v "$command_name" >/dev/null 2>&1 ||
    fail_before_write "required command is missing: ${command_name}"
done
test -f "$REPAIR_SCRIPT" && test ! -L "$REPAIR_SCRIPT" ||
  fail_before_write "repair script is absent or unsafe"
printf '%s  %s\n' "$REPAIR_SCRIPT_SHA256" "$REPAIR_SCRIPT" | sha256sum -c - ||
  fail_before_write "repair script checksum mismatch"

for unit in redis5.service redis7.service; do
  test "$(systemctl is-enabled "$unit" 2>/dev/null || true)" = "enabled" ||
    fail_before_write "expected failed unit is not enabled: ${unit}"
  test "$(systemctl is-active "$unit" 2>/dev/null || true)" = "failed" ||
    fail_before_write "expected failed unit is not failed: ${unit}"
done
for unit in sentinel5.service sentinel7.service orchestrator.service; do
  test "$(systemctl is-enabled "$unit" 2>/dev/null || true)" = "disabled" ||
    fail_before_write "auxiliary unit is not disabled: ${unit}"
  test "$(systemctl is-active "$unit" 2>/dev/null || true)" = "inactive" ||
    fail_before_write "auxiliary unit is not inactive: ${unit}"
done
if ss -lntupH |
  grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)' >/dev/null; then
  fail_before_write "target listener exists before dependency install"
fi

if command -v semanage >/dev/null 2>&1; then
  fail_before_write "semanage is already present; do not create an unnecessary DNF transaction"
fi

candidate="$(
  dnf -q repoquery --latest-limit 1 --archlist=noarch \
    --qf '%{name}-%{version}-%{release}.%{arch}' "$PACKAGE_NAME" |
    sort -u
)"
test -n "$candidate" || fail_before_write "repository candidate is absent"
test "$(printf '%s\n' "$candidate" | wc -l)" -eq 1 ||
  fail_before_write "repository candidate is ambiguous"
case "$candidate" in
  policycoreutils-python-utils-*.noarch) ;;
  *) fail_before_write "unexpected repository candidate: ${candidate}" ;;
esac

set +e
plan="$(
  dnf --setopt=install_weak_deps=False --assumeno install "$candidate" 2>&1
)"
plan_rc=$?
set -e
test "$plan_rc" -eq 1 ||
  fail_before_write "DNF assumeno returned unexpected rc=${plan_rc}"
grep -Fq "$PACKAGE_NAME" <<<"$plan" ||
  fail_before_write "DNF plan does not include required package"
if grep -Eq '^(Upgrading|Removing|Downgrading):|^[[:space:]]+(Upgrade|Remove|Downgrade)[[:space:]]' <<<"$plan"; then
  fail_before_write "DNF plan contains upgrade/remove/downgrade actions"
fi

echo "Q131_SEMANAGE_DNF_PLAN_GATE=PASS|candidate=${candidate}|actions=INSTALL_ONLY"

install -d -o root -g root -m 0700 "$EVIDENCE_DIR"
exec 3>&1 4>&2
exec >"$AUDIT_LOG" 2>&1

finalize() {
  local rc=$?
  trap - EXIT
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG"
  if test "$rc" -eq 0; then
    printf 'Q131_SEMANAGE_INSTALL_AND_REPAIR=PASS_ROLE_ACTIVATED_LOCAL_ONLY\n'
  else
    printf 'Q131_SEMANAGE_INSTALL_AND_REPAIR=FAIL_STOP\n'
  fi
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG" >&3
  if test "$rc" -eq 0; then
    printf 'Q131_SEMANAGE_INSTALL_AND_REPAIR=PASS_ROLE_ACTIVATED_LOCAL_ONLY\n' >&3
  else
    printf 'Q131_SEMANAGE_INSTALL_AND_REPAIR=FAIL_STOP\n' >&3
  fi
}
trap finalize EXIT

echo "AUDIT_BEGIN|${TASK}|$(timestamp)"
echo "RUN_ID=${RUN_ID}"
echo "PACKAGE_CANDIDATE=${candidate}"
echo "=== DNF ASSUMENO PLAN ==="
printf '%s\n' "$plan"

dnf_history_before="$(
  dnf history list 2>/dev/null |
    awk 'NR > 2 && $1 ~ /^[0-9]+$/ {print $1; exit}'
)"
echo "DNF_HISTORY_BEFORE=${dnf_history_before}"

dnf -y --setopt=install_weak_deps=False install "$candidate"

command -v semanage >/dev/null 2>&1
rpm -q "$PACKAGE_NAME"
dnf_history_after="$(
  dnf history list 2>/dev/null |
    awk 'NR > 2 && $1 ~ /^[0-9]+$/ {print $1; exit}'
)"
test -n "$dnf_history_after"
test "$dnf_history_after" != "$dnf_history_before"
echo "DNF_HISTORY_AFTER=${dnf_history_after}"
dnf history info "$dnf_history_after"

temp_result="$(mktemp "${EVIDENCE_DIR}/.result.XXXXXX")"
{
  printf 'dependency_install=PASS\n'
  printf 'package=%s\n' "$(rpm -q "$PACKAGE_NAME")"
  printf 'dnf_transaction_id=%s\n' "$dnf_history_after"
  printf 'repair_script_sha256=%s\n' "$REPAIR_SCRIPT_SHA256"
} >"$temp_result"
install -o root -g root -m 0600 "$temp_result" "$RESULT_FILE"
rm -f -- "$temp_result"

"$REPAIR_SCRIPT"

echo "Q131_SEMANAGE_INSTALL=PASS"
echo "Q131_SEMANAGE_INSTALL_DNF_TRANSACTION=${dnf_history_after}"
echo "Q131_SEMANAGE_INSTALL_AND_REPAIR=PASS_ROLE_ACTIVATED_LOCAL_ONLY"
echo "Q132=LOCKED_NOT_EXECUTED"