#!/usr/bin/env bash

set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS01_Q131_RESUME_AFTER_CONTROL_FLOW_FIX
readonly EXPECTED_HOST=sqjcredis01
readonly EXPECTED_IP=10.2.203.112
readonly OLD_ENTRY=/root/redis-q131-q132-delivery/redis-q131-q132
readonly OLD_ENTRY_SHA256=f2f4838c1481fb3b0f207b1ee1b0c1eb737b54eb4511ae1d9990c623c3b2520b
readonly FIXED_ENTRY=/root/redis-q131-q132-v2
readonly FIXED_ENTRY_SHA256=d229ade533bbe22f66f174bbcfccf685b470f00c466a5286649710be14794f5e
readonly FAILED_RUN_ID=q131-postseal-execute-20260730T025009Z-execute
readonly FAILED_EVIDENCE=/var/backups/zhct-q131-132/q131/q131-postseal-execute-20260730T025009Z-execute
readonly AUDIT_ROOT=/var/backups/zhct-q131-control-flow-resume

MODE=execute
AUDIT_DIR=
AUDIT_LOG=
TEMP_ENTRY=

timestamp() {
    date '+%Y-%m-%dT%H:%M:%S%z'
}

die() {
    printf 'ERROR|%s\n' "$*" >&2
    exit 1
}

sanitize() {
    sed -E \
        -e 's/([Pp]assword|[Tt]oken|[Cc]ookie|[Ss]ecret)([[:space:]]*[:=][[:space:]]*)[^[:space:]",}]+/\1\2[REDACTED]/g' \
        -e 's/(requirepass|masterauth|auth-pass)([[:space:]]+).*/\1\2[REDACTED]/g'
}

finalize() {
    local rc=$?
    trap - EXIT
    if [[ -n "$TEMP_ENTRY" && -e "$TEMP_ENTRY" ]]; then
        rm -f -- "$TEMP_ENTRY"
    fi
    if [[ "$MODE" == static ]]; then
        printf 'END|%s_STATIC_VALIDATE|RC=%s\n' "$LABEL" "$rc"
    else
        if [[ "$rc" -eq 0 ]]; then
            printf 'Q131_CONTROL_FLOW_FIX_RESUME=PASS\n'
        else
            printf 'Q131_CONTROL_FLOW_FIX_RESUME=FAIL\n'
        fi
        [[ -n "$AUDIT_LOG" ]] && printf 'AUDIT_LOG=%s\n' "$AUDIT_LOG"
        printf 'END|%s|RC=%s\n' "$LABEL" "$rc"
    fi
    exit "$rc"
}
trap finalize EXIT

static_validate() {
    local script=${BASH_SOURCE[0]}
    bash -n "$script" || die "self bash syntax failed"
    grep -Fqx "readonly EXPECTED_HOST=$EXPECTED_HOST" "$script" ||
        die "hostname constant missing"
    grep -Fqx "readonly EXPECTED_IP=$EXPECTED_IP" "$script" ||
        die "IP constant missing"
    grep -Fqx "readonly OLD_ENTRY_SHA256=$OLD_ENTRY_SHA256" "$script" ||
        die "old entry SHA constant missing"
    grep -Fqx "readonly FIXED_ENTRY_SHA256=$FIXED_ENTRY_SHA256" "$script" ||
        die "fixed entry SHA constant missing"
    grep -Fq 'old_hook' "$script" || die "hook patch contract missing"
    grep -Fq 'old_helper' "$script" || die "helper patch contract missing"
    grep -Fq '"$FIXED_ENTRY" q131 execute' "$script" ||
        die "fixed execute call missing"
    grep -Fq '"$FIXED_ENTRY" q131 verify' "$script" ||
        die "fixed verify call missing"
    grep -Fq '"$FIXED_ENTRY" q131 archive' "$script" ||
        die "fixed archive call missing"
    grep -Fq '"$FIXED_ENTRY" q131 rollback' "$script" ||
        die "bounded verify rollback call missing"
    if grep -Eq 'systemctl[[:space:]]+(enable|start|restart).*(sentinel5|sentinel7|orchestrator)' "$script"; then
        die "forbidden auxiliary unit start detected"
    fi
    if grep -Eq '(cat|head|tail|sha256sum)[[:space:]]+.*redis[57]\.password' "$script"; then
        die "secret content/hash command detected"
    fi
    printf 'Q131_CONTROL_FLOW_FIX_RESUME_STATIC_VALIDATE=PASS\n'
}

if [[ ${1:-} == --static-validate ]]; then
    MODE=static
    static_validate
    exit 0
fi
[[ $# -eq 0 ]] || die "unsupported argument"

printf 'BEGIN|%s|%s\n' "$LABEL" "$(timestamp)"
[[ $(id -u) -eq 0 ]] || die "root is required"
[[ $(hostname -s) == "$EXPECTED_HOST" ]] || die "wrong hostname"
ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Fxq "$EXPECTED_IP" ||
    die "expected IP is absent"
if ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Eq '^10\.2\.203\.(115|116|117)$'
then
    die "VIP is present before Q-251"
fi
printf 'Q131_RESUME_TARGET_IDENTITY=PASS|host=%s|ip=%s\n' \
    "$(hostname -s)" "$EXPECTED_IP"

[[ -f "$OLD_ENTRY" && ! -L "$OLD_ENTRY" && -x "$OLD_ENTRY" ]] ||
    die "old entry missing, linked, or non-executable"
[[ $(stat -c '%U:%G' "$OLD_ENTRY") == root:root ]] ||
    die "old entry owner is not root:root"
printf '%s  %s\n' "$OLD_ENTRY_SHA256" "$OLD_ENTRY" | sha256sum -c -
bash -n "$OLD_ENTRY"
[[ ! -e "$FIXED_ENTRY" && ! -L "$FIXED_ENTRY" ]] ||
    die "fixed entry target already exists"
printf 'Q131_OLD_ENTRY_GATE=PASS\n'

for path in \
    "$FAILED_EVIDENCE/stdout-stderr.log" \
    "$FAILED_EVIDENCE/result.env" \
    "$FAILED_EVIDENCE/execution-receipt.env"
do
    [[ -f "$path" && ! -L "$path" ]] || die "failed-run evidence missing: $path"
    [[ $(stat -c '%U:%G' "$path") == root:root ]] ||
        die "failed-run evidence owner is not root:root: $path"
done
grep -Fxq 'rc=1' "$FAILED_EVIDENCE/execution-receipt.env"
grep -Fxq 'state=FAIL' "$FAILED_EVIDENCE/result.env"
grep -Fxq 'detail=unhandled_exit_rc_1' "$FAILED_EVIDENCE/result.env"
printf 'Q131_FAILED_RUN_RECEIPT_GATE=PASS|run_id=%s\n' "$FAILED_RUN_ID"

[[ -s /etc/machine-id ]] || die "machine-id is not READY"
[[ -f /etc/zhct/node.env && ! -L /etc/zhct/node.env ]] ||
    die "node.env missing or linked"
grep -Fxq 'ROLE=redis' /etc/zhct/node.env
grep -Fxq 'NODE_KEY=redis01' /etc/zhct/node.env
grep -Fxq 'NODE_IP=10.2.203.112' /etc/zhct/node.env
grep -Fxq 'NODE_NAME=sqjcredis01' /etc/zhct/node.env
[[ $(find /etc/ssh -maxdepth 1 -type f -name 'ssh_host_*_key' | wc -l) -eq 3 ]] ||
    die "current private SSH host key count is not 3"
printf 'Q131_READY_IDENTITY_GATE=PASS|private_host_keys=3|content=NOT_READ_NOT_HASHED\n'

for secret in redis5.password redis7.password; do
    path="/etc/zhct/secrets/$secret"
    [[ -f "$path" && ! -L "$path" && -s "$path" ]] ||
        die "secret metadata gate failed: $secret"
    [[ $(stat -c '%U:%G' "$path") == root:root ]] ||
        die "secret owner gate failed: $secret"
    mode=$(stat -c '%a' "$path")
    [[ "$mode" == 600 || "$mode" == 400 ]] ||
        die "secret mode gate failed: $secret"
done
printf 'Q131_SECRET_METADATA_GATE=PASS|values=NOT_OUTPUT_NOT_HASHED\n'

for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
    [[ -f "$config" && ! -L "$config" ]] || die "config missing or linked: $config"
    if grep -Eq '__[A-Z0-9_]+__' "$config"; then
        die "config still contains a placeholder: $config"
    fi
done
printf 'Q131_CONFIG_PLACEHOLDER_GATE=PASS|content=NOT_OUTPUT_NOT_HASHED\n'

for unit in redis5 redis7 sentinel5 sentinel7 orchestrator; do
    [[ $(systemctl is-enabled "$unit.service" 2>/dev/null || true) == disabled ]] ||
        die "$unit.service is not disabled before resume"
    [[ $(systemctl is-active "$unit.service" 2>/dev/null || true) == inactive ]] ||
        die "$unit.service is not inactive before resume"
done
if ss -lntH |
    awk '$4 ~ /:(6379|6387|26379|26387|3000|10008)$/ {found=1} END {exit !found}'
then
    die "target listener exists before resume"
fi
printf 'Q131_RESUME_QUIET_GATE=PASS\n'

resume_id="q131-control-flow-fix-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="$AUDIT_ROOT/$resume_id"
AUDIT_LOG="$AUDIT_DIR/operator.log"
[[ ! -e "$AUDIT_DIR" && ! -L "$AUDIT_DIR" ]] ||
    die "resume audit directory already exists"
install -d -m 0700 -o root -g root -- "$AUDIT_ROOT" "$AUDIT_DIR"
exec > >(sanitize | tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(timestamp)"
printf 'RESUME_ID=%s\n' "$resume_id"

TEMP_ENTRY=$(mktemp /root/.redis-q131-q132-v2.XXXXXX)
python3 - "$OLD_ENTRY" "$TEMP_ENTRY" <<'PY'
import pathlib
import sys

source = pathlib.Path(sys.argv[1]).read_text(encoding="utf-8")

old_hook = '''    for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
        grep -Eq '__[A-Z0-9_]+__' "$config" && die "secret placeholder has not been injected: $config"
    done
'''
new_hook = '''    for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
        if grep -Eq '__[A-Z0-9_]+__' "$config"; then
            die "secret placeholder has not been injected: $config"
        fi
    done
'''
old_helper = '''    set +e
    RUN_ID="$activation_id" \\
        "$BUNDLE_ROOT/common/scripts/activate-role.sh" \\
        --role redis \\
        --bundle-root "$policy_root"
    activate_rc=$?
    set -e
'''
new_helper = '''    if RUN_ID="$activation_id" \\
        "$BUNDLE_ROOT/common/scripts/activate-role.sh" \\
        --role redis \\
        --bundle-root "$policy_root"
    then
        activate_rc=0
    else
        activate_rc=$?
    fi
'''
if source.count(old_hook) != 1:
    raise SystemExit("old hook contract count is not 1")
if source.count(old_helper) != 1:
    raise SystemExit("old helper contract count is not 1")
fixed = source.replace(old_hook, new_hook).replace(old_helper, new_helper)
pathlib.Path(sys.argv[2]).write_text(fixed, encoding="utf-8")
PY
printf '%s  %s\n' "$FIXED_ENTRY_SHA256" "$TEMP_ENTRY" | sha256sum -c -
bash -n "$TEMP_ENTRY"
install -o root -g root -m 0700 "$TEMP_ENTRY" "$FIXED_ENTRY"
rm -f -- "$TEMP_ENTRY"
TEMP_ENTRY=
printf '%s  %s\n' "$FIXED_ENTRY_SHA256" "$FIXED_ENTRY" | sha256sum -c -
printf 'Q131_FIXED_ENTRY_INSTALL=PASS|path=%s\n' "$FIXED_ENTRY"

execute_run_id="${resume_id}-execute"
"$FIXED_ENTRY" q131 execute --run-id "$execute_run_id"
printf 'Q131_FIXED_EXECUTE=PASS|run_id=%s\n' "$execute_run_id"

verify_run_id="${resume_id}-verify"
if "$FIXED_ENTRY" q131 verify --run-id "$verify_run_id"; then
    verify_rc=0
else
    verify_rc=$?
    rollback_run_id="${resume_id}-rollback"
    if "$FIXED_ENTRY" q131 rollback \
        --activation-run-id "${execute_run_id}-activate" \
        --run-id "$rollback_run_id"
    then
        rollback_rc=0
    else
        rollback_rc=$?
    fi
    printf 'Q131_FIXED_VERIFY=FAIL|rc=%s|rollback_rc=%s\n' \
        "$verify_rc" "$rollback_rc"
    exit "$verify_rc"
fi
printf 'Q131_FIXED_VERIFY=PASS|run_id=%s\n' "$verify_run_id"

"$FIXED_ENTRY" q131 archive --source-run-id "$execute_run_id"
"$FIXED_ENTRY" q131 archive --source-run-id "$verify_run_id"
printf 'Q131_FIXED_ARCHIVE=PASS|execute_run=%s|verify_run=%s\n' \
    "$execute_run_id" "$verify_run_id"

for unit in redis5 redis7; do
    [[ $(systemctl is-enabled "$unit.service" 2>/dev/null || true) == enabled ]] ||
        die "$unit.service is not enabled after resume"
    [[ $(systemctl is-active "$unit.service" 2>/dev/null || true) == active ]] ||
        die "$unit.service is not active after resume"
done
for unit in sentinel5 sentinel7 orchestrator; do
    [[ $(systemctl is-enabled "$unit.service" 2>/dev/null || true) == disabled ]] ||
        die "$unit.service is not disabled after resume"
    [[ $(systemctl is-active "$unit.service" 2>/dev/null || true) == inactive ]] ||
        die "$unit.service is not inactive after resume"
done
printf 'Q131_FINAL_UNIT_POLICY=PASS_REDIS5_REDIS7_ONLY\n'
printf 'SENTINEL5_SENTINEL7_ORCHESTRATOR=DISABLED_INACTIVE\n'
printf 'VIP=NOT_ENABLED\n'
printf 'CROSS_HOST_HA=NOT_ACCEPTED_BEFORE_Q200_Q230_Q231\n'