#!/usr/bin/env bash
set -Eeuo pipefail

TASK="REDIS01_Q131_POST_V3_STARTUP_DIAGNOSIS"
EXPECTED_HOST="sqjcredis01"
EXPECTED_IP="10.2.203.112"
FAILED_RUN_ID="q131-selinux-repair-v3-20260803T074950Z"
FAILED_AUDIT="/var/backups/zhct-q131-selinux-repair-v3/${FAILED_RUN_ID}/operator.log"
FAILED_AUDIT_SHA256="6a28c73e53c8719f74f0383fc824970988e318a5e74b70f37e0b2976509a7424"
SINCE="2026-08-03 15:49:45"
RUN_ID="q131-post-v3-diagnosis-$(date -u +%Y%m%dT%H%M%SZ)"
EVIDENCE_DIR="/var/backups/zhct-q131-post-v3-diagnosis/${RUN_ID}"
AUDIT_LOG="${EVIDENCE_DIR}/operator.log"

if test "${1:-}" = "--static-validate"; then
  echo "Q131_POST_V3_STARTUP_DIAGNOSIS_STATIC_VALIDATE=PASS"
  echo "TARGET_HOST=${EXPECTED_HOST}"
  echo "TARGET_IP=${EXPECTED_IP}"
  echo "FAILED_RUN_ID=${FAILED_RUN_ID}"
  echo "SERVICE_MUTATION=ZERO"
  echo "SELINUX_MUTATION=ZERO"
  echo "SECRET_VALUES=NOT_OUTPUT_NOT_HASHED"
  exit 0
fi

printf 'BEGIN|%s|%s\n' "$TASK" "$(date --iso-8601=seconds)"

fail_before_audit() {
  printf 'ERROR: %s\n' "$1"
  printf 'END|%s|RC=1|PERSISTENT_WRITE=ZERO\n' "$TASK"
  exit 1
}

test "$(id -u)" -eq 0 || fail_before_audit "root is required"
actual_host="$(hostname -s)"
test "$actual_host" = "$EXPECTED_HOST" || fail_before_audit "hostname mismatch: actual=${actual_host} expected=${EXPECTED_HOST}"
ip -4 -o addr show scope global | awk '{print $4}' | cut -d/ -f1 | grep -Fxq "$EXPECTED_IP" ||
  fail_before_audit "expected IPv4 is absent: ${EXPECTED_IP}"

test -f "$FAILED_AUDIT" && test ! -L "$FAILED_AUDIT" || fail_before_audit "v3 audit is absent or unsafe"
printf '%s  %s\n' "$FAILED_AUDIT_SHA256" "$FAILED_AUDIT" | sha256sum -c - ||
  fail_before_audit "v3 audit checksum mismatch"
grep -Fxq "RUN_ID=${FAILED_RUN_ID}" "$FAILED_AUDIT" || fail_before_audit "v3 run id mismatch"
grep -Fxq 'Q131_SELINUX_LABEL_REPAIR_V3=FAIL_ROLLED_BACK_SAFE_QUIET' "$FAILED_AUDIT" ||
  fail_before_audit "v3 safe rollback receipt is absent"

echo "Q131_POST_V3_DIAG_TARGET_IDENTITY=PASS|host=${actual_host}|ip=${EXPECTED_IP}"
echo "Q131_V3_FAILED_AUDIT_GATE=PASS|run_id=${FAILED_RUN_ID}"

install -d -o root -g root -m 0700 "$EVIDENCE_DIR"
exec 3>&1 4>&2
exec >"$AUDIT_LOG" 2>&1

finalize() {
  local rc=$?
  trap - EXIT
  printf 'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED\n'
  printf 'SERVICE_MUTATION=ZERO\n'
  printf 'SELINUX_MUTATION=ZERO\n'
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG"
  printf 'Q131_POST_V3_STARTUP_DIAGNOSIS=%s\n' "$(test "$rc" -eq 0 && printf PASS_READ_ONLY || printf FAIL_CAPTURE)" >&3
  printf 'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED\n' >&3
  printf 'SERVICE_MUTATION=ZERO\n' >&3
  printf 'SELINUX_MUTATION=ZERO\n' >&3
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG" >&3
}
trap finalize EXIT

redact_sensitive_lines() {
  awk 'BEGIN{IGNORECASE=1} /requirepass|masterauth|password|secret|token|cookie/ {print "[REDACTED_SENSITIVE_LINE]"; next} {print}'
}

echo "AUDIT_BEGIN|${TASK}|$(date --iso-8601=seconds)"
echo "RUN_ID=${RUN_ID}"
echo "TARGET_HOST=${EXPECTED_HOST}"
echo "TARGET_IP=${EXPECTED_IP}"
echo "FAILED_RUN_ID=${FAILED_RUN_ID}"

echo "=== V3 FAILURE RECEIPT ==="
awk '/Q131_|FINAL_RC=|ERROR:|END\|REDIS01_Q131_SELINUX_LABEL_REPAIR_AND_VERIFY_V3/ {print}' "$FAILED_AUDIT" |
  redact_sensitive_lines

echo "=== CURRENT UNIT SUMMARY ==="
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
  printf 'UNIT|%s|' "$unit"
  systemctl show "$unit" -p LoadState -p UnitFileState -p ActiveState -p SubState -p Result \
    -p ExecMainCode -p ExecMainStatus -p NRestarts --value 2>/dev/null | paste -sd '|' - || true
done

for unit in redis5.service redis7.service; do
  echo "=== STATUS ${unit} ==="
  systemctl status "$unit" --no-pager -l 2>&1 | redact_sensitive_lines || true
  echo "=== SHOW ${unit} ==="
  systemctl show "$unit" -p FragmentPath -p User -p Group -p Type -p Restart -p RestartUSec \
    -p ExecStart -p ActiveState -p SubState -p Result -p ExecMainCode -p ExecMainStatus \
    -p NRestarts -p StateChangeTimestamp -p InactiveEnterTimestamp 2>&1 |
    redact_sensitive_lines || true
  echo "=== JOURNAL ${unit} SINCE V3 ==="
  journalctl -u "$unit" --since "$SINCE" --no-pager -o short-iso-precise 2>&1 |
    redact_sensitive_lines || true
done

echo "=== UNIT FILES ==="
systemctl cat redis5.service redis7.service 2>&1 | redact_sensitive_lines || true

echo "=== SAFE CONFIG DIRECTIVES ==="
for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
  echo "CONFIG=${config}"
  if test -f "$config" && test ! -L "$config"; then
    stat -c 'FILE|%F|%A|%U:%G|%s|%n' "$config"
    awk '
      /^[[:space:]]*(requirepass|masterauth)[[:space:]]/ {next}
      /^[[:space:]]*(bind|protected-mode|port|daemonize|supervised|pidfile|loglevel|logfile|dir|dbfilename|appendonly|appendfilename|appendfsync)[[:space:]]/ {print}
    ' "$config"
  else
    echo "CONFIG_STATE=ABSENT_OR_UNSAFE"
  fi
done
echo "SECRET_VALUES=NOT_OUTPUT_NOT_HASHED"

echo "=== PATH METADATA AND SELINUX CONTEXTS ==="
for path in \
  /opt/redis/5.0.14/bin /opt/redis/5.0.14/bin/redis-server \
  /opt/redis/7.2.14/bin /opt/redis/7.2.14/bin/redis-server \
  /etc/redis /etc/redis/redis5.conf /etc/redis/redis7.conf \
  /data/redis5 /data/redis7 /var/log/redis5 /var/log/redis7 \
  /run/redis5 /run/redis7; do
  if test -e "$path" || test -L "$path"; then
    stat -c 'META|%F|%A|%a|%U:%G|%s|%n' "$path"
    ls -Zd "$path" 2>&1 || true
  else
    echo "ABSENT|${path}"
  fi
done

echo "=== SELINUX POLICY ENTRIES ==="
getenforce 2>&1 || true
semanage fcontext -l 2>&1 |
  grep -E '/opt/redis/(5\.0\.14|7\.2\.14)/bin|/etc/redis|/data/redis[57]|/var/log/redis[57]|/var/run/redis[57]' || true
semanage port -l 2>&1 | awk '$1 == "redis_port_t" || $0 ~ /(^|,|[[:space:]])(6379|6387)(,|[[:space:]]|$)/ {print}' || true

echo "=== AVC DENIALS SINCE V3 ==="
if command -v ausearch >/dev/null 2>&1; then
  ausearch -m AVC,USER_AVC -ts 08/03/2026 15:49:45 2>&1 |
    redact_sensitive_lines | tail -n 240 || true
else
  journalctl --since "$SINCE" --no-pager 2>&1 |
    grep -Ei 'avc:|denied|redis-server' | redact_sensitive_lines | tail -n 240 || true
fi

echo "=== PROCESSES LISTENERS FAILED UNITS ==="
ps -eo pid=,ppid=,user=,stat=,comm=,args= |
  awk '$5 ~ /^(redis-server|redis-sentinel|orchestrator)$/ {print}' | redact_sensitive_lines || true
ss -lntupH |
  grep -E ':(6379|6387|26379|26387|3000|10008|16379|16387|36379|36387)([[:space:]]|$)' ||
  echo "TARGET_LISTENERS=NONE"
systemctl --failed --no-legend --plain 2>&1 || true

echo "Q131_POST_V3_STARTUP_DIAGNOSIS=PASS_READ_ONLY"