#!/usr/bin/env bash
set -Eeuo pipefail

TASK="REDIS01_Q131_RUNTIME_FAILURE_DIAGNOSIS_20260804"
EXPECTED_HOST="sqjcredis01"
EXPECTED_IP="10.2.203.112"
FAILED_RUN_ID="q131-selinux-repair-v3-20260804T030424Z"
FAILED_AUDIT="/var/backups/zhct-q131-selinux-repair-v3/${FAILED_RUN_ID}/operator.log"
FAILED_AUDIT_SHA256="b36da99430be1954454ce01c9c422646d67370b67a3169b70acb231e7cde4578"
JOURNAL_SINCE="2026-08-04 11:04:20"
RUN_ID="q131-runtime-diagnosis-$(date -u +%Y%m%dT%H%M%SZ)"
EVIDENCE_DIR="/var/backups/zhct-q131-runtime-diagnosis/${RUN_ID}"
AUDIT_LOG="${EVIDENCE_DIR}/operator.log"

if test "${1:-}" = "--static-validate"; then
  echo "Q131_RUNTIME_FAILURE_DIAGNOSIS_STATIC_VALIDATE=PASS"
  echo "TARGET_HOST=${EXPECTED_HOST}"
  echo "TARGET_IP=${EXPECTED_IP}"
  echo "FAILED_RUN_ID=${FAILED_RUN_ID}"
  echo "SERVICE_MUTATION=ZERO"
  echo "SELINUX_MUTATION=ZERO"
  echo "SECRET_VALUES=NOT_OUTPUT_NOT_HASHED"
  exit 0
fi

printf 'BEGIN|%s|%s\n' "$TASK" "$(date --iso-8601=seconds)"

fail_before_audit() {
  echo "ERROR: $*"
  printf 'END|%s|RC=1|PERSISTENT_WRITE=ZERO\n' "$TASK"
  exit 1
}

test "$(id -u)" -eq 0 || fail_before_audit "root is required"
actual_host="$(hostname -s)"
test "$actual_host" = "$EXPECTED_HOST" ||
  fail_before_audit "hostname mismatch: actual=${actual_host} expected=${EXPECTED_HOST}"
ip -4 -o addr show scope global | awk '{print $4}' | cut -d/ -f1 |
  grep -Fxq "$EXPECTED_IP" || fail_before_audit "expected IPv4 is absent: ${EXPECTED_IP}"
test -f "$FAILED_AUDIT" && test ! -L "$FAILED_AUDIT" || fail_before_audit "failed audit absent or unsafe"
printf '%s  %s\n' "$FAILED_AUDIT_SHA256" "$FAILED_AUDIT" | sha256sum -c - ||
  fail_before_audit "failed audit checksum mismatch"
grep -Fxq "RUN_ID=${FAILED_RUN_ID}" "$FAILED_AUDIT" || fail_before_audit "failed run id mismatch"
grep -Fxq 'Q131_SELINUX_LABEL_REPAIR_V3=FAIL_ROLLED_BACK_SAFE_QUIET' "$FAILED_AUDIT" ||
  fail_before_audit "safe rollback receipt absent"

echo "Q131_RUNTIME_DIAG_TARGET_IDENTITY=PASS|host=${actual_host}|ip=${EXPECTED_IP}"
echo "Q131_FAILED_RUN_AUDIT_GATE=PASS|run_id=${FAILED_RUN_ID}"

install -d -o root -g root -m 0700 "$EVIDENCE_DIR"
exec 3>&1 4>&2
exec >"$AUDIT_LOG" 2>&1

finalize() {
  local rc=$?
  trap - EXIT
  printf 'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED\n'
  printf 'SERVICE_MUTATION=ZERO\n'
  printf 'SELINUX_MUTATION=ZERO\n'
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG"
  printf 'Q131_RUNTIME_FAILURE_DIAGNOSIS=%s\n' "$(test "$rc" -eq 0 && printf PASS_READ_ONLY || printf FAIL_CAPTURE)" >&3
  printf 'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED\nSERVICE_MUTATION=ZERO\nSELINUX_MUTATION=ZERO\n' >&3
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG" >&3
}
trap finalize EXIT

redact() {
  awk 'BEGIN{IGNORECASE=1} /requirepass|masterauth|password|secret|token|cookie/ {print "[REDACTED_SENSITIVE_LINE]"; next} {print}'
}

echo "AUDIT_BEGIN|${TASK}|$(date --iso-8601=seconds)"
echo "RUN_ID=${RUN_ID}"
echo "FAILED_RUN_ID=${FAILED_RUN_ID}"

echo "=== CURRENT UNIT SUMMARY ==="
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
  printf 'UNIT|%s|' "$unit"
  systemctl show "$unit" -p LoadState -p UnitFileState -p ActiveState -p SubState -p Result \
    -p ExecMainCode -p ExecMainStatus -p NRestarts --value 2>/dev/null | paste -sd '|' - || true
done

for unit in redis5.service redis7.service; do
  echo "=== STATUS ${unit} ==="
  systemctl status "$unit" --no-pager -l 2>&1 | redact || true
  echo "=== JOURNAL ${unit} SINCE FAILED RUN ==="
  journalctl -u "$unit" --since "$JOURNAL_SINCE" --no-pager -o short-iso-precise 2>&1 | redact || true
done

echo "=== SAFE CONFIG AND PARENT METADATA ==="
stat -c 'META|%F|%A|%a|%U:%G|%s|%n' /etc /etc/redis 2>&1 || true
ls -Zd /etc /etc/redis 2>&1 || true
for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
  echo "CONFIG=${config}"
  if test -f "$config" && test ! -L "$config"; then
    stat -c 'META|%F|%A|%a|%U:%G|%s|%n' "$config"
    ls -Zd "$config" 2>&1 || true
    awk '
      /^[[:space:]]*(requirepass|masterauth)[[:space:]]/ {next}
      /^[[:space:]]*(bind|protected-mode|port|daemonize|supervised|pidfile|loglevel|logfile|dir|dbfilename|appendonly|appendfilename|appendfsync)[[:space:]]/ {print}
    ' "$config"
  else
    echo "CONFIG_STATE=ABSENT_OR_UNSAFE"
  fi
done
echo "SECRET_VALUES=NOT_OUTPUT_NOT_HASHED"

echo "=== RUNTIME PATH METADATA AND CONTEXTS ==="
for path in /opt/redis/5.0.14/bin/redis-server /opt/redis/7.2.14/bin/redis-server \
  /data/redis5 /data/redis7 /var/log/redis5 /var/log/redis7 /run/redis5 /run/redis7; do
  if test -e "$path" || test -L "$path"; then
    stat -c 'META|%F|%A|%a|%U:%G|%s|%n' "$path"
    ls -Zd "$path" 2>&1 || true
  else
    echo "ABSENT|${path}"
  fi
done

echo "=== FAILED RUN WINDOW AVC ==="
if command -v ausearch >/dev/null 2>&1; then
  ausearch -m AVC,USER_AVC -ts 11:04:20 2>&1 | redact | tail -n 300 || true
else
  journalctl --since "$JOURNAL_SINCE" --no-pager 2>&1 |
    grep -Ei 'avc:|denied|redis-server' | redact | tail -n 300 || true
fi

echo "=== LISTENERS PROCESSES FAILED UNITS ==="
ss -lntupH | grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)' || echo "TARGET_LISTENERS=NONE"
ps -eo pid=,ppid=,user=,stat=,comm=,args= |
  awk '$5 ~ /^(redis-server|redis-sentinel|orchestrator)$/ {print}' | redact || true
systemctl --failed --no-legend --plain 2>&1 || true

echo "Q131_RUNTIME_FAILURE_DIAGNOSIS=PASS_READ_ONLY"