#!/usr/bin/env bash
set -Eeuo pipefail

TASK="REDIS01_Q131_STARTUP_FAILURE_DIAGNOSIS"
EXPECTED_HOST="sqjcredis01"
EXPECTED_IP="10.2.203.112"
FAILED_RESUME_ID="q131-control-flow-fix-20260730T031046Z"
FAILED_RESUME_LOG="/var/backups/zhct-q131-control-flow-resume/${FAILED_RESUME_ID}/operator.log"
RUN_ID="q131-startup-diagnosis-$(date -u +%Y%m%dT%H%M%SZ)"
EVIDENCE_DIR="/var/backups/zhct-q131-startup-diagnosis/${RUN_ID}"
AUDIT_LOG="${EVIDENCE_DIR}/operator.log"

if test "${1:-}" = "--static-validate"; then
  echo "Q131_STARTUP_FAILURE_DIAGNOSIS_STATIC_VALIDATE=PASS"
  echo "TARGET_HOST=${EXPECTED_HOST}"
  echo "TARGET_IP=${EXPECTED_IP}"
  echo "SERVICE_MUTATION=ZERO"
  echo "SECRET_VALUES=NOT_OUTPUT_NOT_HASHED"
  exit 0
fi

printf 'BEGIN|%s|%s\n' "$TASK" "$(date --iso-8601=seconds)"

if test "$(id -u)" -ne 0; then
  echo "ERROR: root is required"
  printf 'END|%s|RC=1\n' "$TASK"
  exit 1
fi

actual_host="$(hostname -s)"
if test "$actual_host" != "$EXPECTED_HOST"; then
  echo "ERROR: hostname mismatch: actual=${actual_host} expected=${EXPECTED_HOST}"
  printf 'END|%s|RC=1\n' "$TASK"
  exit 1
fi
if ! ip -4 -o addr show scope global | awk '{print $4}' | cut -d/ -f1 | grep -Fxq "$EXPECTED_IP"; then
  echo "ERROR: expected IPv4 is absent: ${EXPECTED_IP}"
  printf 'END|%s|RC=1\n' "$TASK"
  exit 1
fi

echo "Q131_STARTUP_DIAG_TARGET_IDENTITY=PASS|host=${actual_host}|ip=${EXPECTED_IP}"

install -d -o root -g root -m 0700 "$EVIDENCE_DIR"
exec 3>&1 4>&2
exec >"$AUDIT_LOG" 2>&1

finalize() {
  local rc=$?
  trap - EXIT
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG"
  printf 'Q131_STARTUP_DIAGNOSIS=%s\n' "$(
    if test "$rc" -eq 0; then printf PASS_READ_ONLY; else printf FAIL_CAPTURE; fi
  )"
  printf 'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED\n'
  printf 'SERVICE_MUTATION=ZERO\n'
  printf 'Q131_STARTUP_DIAGNOSIS=%s\n' "$(
    if test "$rc" -eq 0; then printf PASS_READ_ONLY; else printf FAIL_CAPTURE; fi
  )" >&3
  printf 'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED\n' >&3
  printf 'SERVICE_MUTATION=ZERO\n' >&3
  printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$TASK" "$rc" "$AUDIT_LOG" >&3
}
trap finalize EXIT

echo "AUDIT_BEGIN|${TASK}|$(date --iso-8601=seconds)"
echo "RUN_ID=${RUN_ID}"
echo "TARGET_HOST=${EXPECTED_HOST}"
echo "TARGET_IP=${EXPECTED_IP}"
echo "FAILED_RESUME_ID=${FAILED_RESUME_ID}"

echo "=== FAILED RESUME RECEIPT ==="
if test -f "$FAILED_RESUME_LOG" && test ! -L "$FAILED_RESUME_LOG"; then
  stat -c 'FILE|%F|%A|%U:%G|%s|%n' "$FAILED_RESUME_LOG"
  awk '
    /requirepass|masterauth/ {print "[REDACTED_SECRET_DIRECTIVE_LINE]"; next}
    /Q131_|FINAL_RC=|ERROR:|END\|REDIS01_Q131_RESUME_AFTER_CONTROL_FLOW_FIX/ {print}
  ' "$FAILED_RESUME_LOG" | tail -n 120
else
  echo "FAILED_RESUME_LOG=ABSENT_OR_UNSAFE"
fi

echo "=== UNIT SUMMARY ==="
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
  printf 'UNIT|%s|' "$unit"
  systemctl show "$unit" \
    -p LoadState -p UnitFileState -p ActiveState -p SubState -p Result \
    -p ExecMainCode -p ExecMainStatus -p NRestarts --value 2>/dev/null |
    paste -sd '|' - || true
done

echo "=== REDIS5 STATUS ==="
systemctl status redis5.service --no-pager -l 2>&1 |
  awk '/requirepass|masterauth/ {print "[REDACTED_SECRET_DIRECTIVE_LINE]"; next} {print}' || true
echo "=== REDIS7 STATUS ==="
systemctl status redis7.service --no-pager -l 2>&1 |
  awk '/requirepass|masterauth/ {print "[REDACTED_SECRET_DIRECTIVE_LINE]"; next} {print}' || true

echo "=== REDIS5 JOURNAL SINCE FAILED RESUME ==="
journalctl -u redis5.service --since "2026-07-30 11:10:40" --no-pager -o short-iso-precise 2>&1 |
  awk '/requirepass|masterauth/ {print "[REDACTED_SECRET_DIRECTIVE_LINE]"; next} {print}' || true
echo "=== REDIS7 JOURNAL SINCE FAILED RESUME ==="
journalctl -u redis7.service --since "2026-07-30 11:10:40" --no-pager -o short-iso-precise 2>&1 |
  awk '/requirepass|masterauth/ {print "[REDACTED_SECRET_DIRECTIVE_LINE]"; next} {print}' || true

echo "=== UNIT FILES ==="
systemctl cat redis5.service 2>&1 || true
systemctl cat redis7.service 2>&1 || true

echo "=== SAFE CONFIG DIRECTIVES ==="
for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
  echo "CONFIG=${config}"
  if test -f "$config" && test ! -L "$config"; then
    stat -c 'FILE|%F|%A|%U:%G|%s|%n' "$config"
    awk '
      /^[[:space:]]*(requirepass|masterauth)[[:space:]]/ {next}
      /^[[:space:]]*(bind|protected-mode|port|tcp-backlog|timeout|tcp-keepalive|daemonize|supervised|pidfile|loglevel|logfile|databases|always-show-logo|dir|dbfilename|appendonly|appendfilename|appendfsync|save)[[:space:]]/ {print}
    ' "$config"
  else
    echo "CONFIG_STATE=ABSENT_OR_UNSAFE"
  fi
done
echo "SECRET_VALUES=NOT_OUTPUT_NOT_HASHED"

echo "=== PATH TRAVERSAL AND METADATA ==="
for path in \
  /opt/redis/5.0.14/bin/redis-server \
  /opt/redis/7.2.14/bin/redis-server \
  /etc/redis/redis5.conf \
  /etc/redis/redis7.conf \
  /data/redis5 \
  /data/redis7 \
  /var/log/redis5 \
  /var/log/redis7 \
  /run/redis5 \
  /run/redis7; do
  echo "PATH=${path}"
  if test -e "$path" || test -L "$path"; then
    stat -c 'META|%F|%A|%a|%U:%G|%s|%n' "$path"
    namei -l "$path" 2>&1 || true
  else
    echo "PATH_STATE=ABSENT"
  fi
done

echo "=== DATA AND LOG DIRECTORY ENTRIES METADATA ONLY ==="
for dir in /data/redis5 /data/redis7 /var/log/redis5 /var/log/redis7 /run/redis5 /run/redis7; do
  echo "DIR=${dir}"
  if test -d "$dir" && test ! -L "$dir"; then
    find "$dir" -mindepth 1 -maxdepth 1 -printf 'ENTRY|%y|%M|%u:%g|%s|%p\n' 2>&1 | sort
  else
    echo "DIR_STATE=ABSENT_OR_UNSAFE"
  fi
done

echo "=== REDIS USER EXECUTION PROBES ==="
id redis 2>&1 || true
set +e
runuser -u redis -- test -x /opt/redis/5.0.14/bin/redis-server
echo "REDIS5_TEST_X_RC=$?"
runuser -u redis -- /opt/redis/5.0.14/bin/redis-server --version
echo "REDIS5_VERSION_RC=$?"
runuser -u redis -- test -x /opt/redis/7.2.14/bin/redis-server
echo "REDIS7_TEST_X_RC=$?"
runuser -u redis -- /opt/redis/7.2.14/bin/redis-server --version
echo "REDIS7_VERSION_RC=$?"
set -e

echo "=== SELINUX AND RECENT DENIALS ==="
if command -v getenforce >/dev/null 2>&1; then
  getenforce
else
  echo "GETENFORCE=UNAVAILABLE"
fi
ls -Zd /opt/redis/5.0.14/bin/redis-server /opt/redis/7.2.14/bin/redis-server \
  /etc/redis /data/redis5 /data/redis7 /var/log/redis5 /var/log/redis7 2>&1 || true
if command -v ausearch >/dev/null 2>&1; then
  ausearch -m AVC,USER_AVC -ts 2026-07-30 11:10:40 2>&1 |
    awk '/requirepass|masterauth/ {print "[REDACTED_SECRET_DIRECTIVE_LINE]"; next} {print}' |
    tail -n 160 || true
else
  journalctl --since "2026-07-30 11:10:40" --no-pager 2>&1 |
    grep -Ei 'avc:|denied|redis-server' |
    awk '/requirepass|masterauth/ {print "[REDACTED_SECRET_DIRECTIVE_LINE]"; next} {print}' |
    tail -n 160 || true
fi

echo "=== PROCESSES LISTENERS FAILED UNITS ==="
ps -eo pid=,ppid=,user=,stat=,comm=,args= |
  awk '$5 ~ /^(redis-server|redis-sentinel|orchestrator)$/ {print}' || true
ss -lntupH |
  grep -E ':(6379|6387|26379|26387|3000|10008|16379|16387|36379|36387)([[:space:]]|$)' ||
  echo "TARGET_LISTENERS=NONE"
systemctl --failed --no-legend --plain 2>&1 || true

echo "Q131_STARTUP_DIAGNOSIS=PASS_READ_ONLY"
echo "SECRET_VALUES=NOT_OUTPUT_NOT_HASHED"
echo "SERVICE_MUTATION=ZERO"