#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_ACTIVATION_READINESS_DIAGNOSIS
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly ENTRY=/root/redis-q131-q132-delivery-v2/redis-q131-q132
readonly ENTRY_SHA256=d229ade533bbe22f66f174bbcfccf685b470f00c466a5286649710be14794f5e
readonly OWNER_AUDIT=/var/backups/zhct-q132-owner-repair-v2/q132-owner-repair-v2-20260805T095934Z/operator.log
readonly IMPORT_AUDIT=/var/backups/zhct-q132-secret-import/q132-secret-import-20260805T095934Z/operator.log
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-activation-readiness-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q132-activation-readiness/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"

finish() {
    local rc=$?
    trap - EXIT
    printf '%s\n' \
        'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED' \
        'SERVICE_MUTATION=ZERO' \
        'SELINUX_MUTATION=ZERO'
    printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$LABEL" "$rc" "$AUDIT_LOG"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    [[ "$EXPECTED_HOST" == sqjcredis02 ]]
    [[ "$EXPECTED_IP" == 10.2.203.113 ]]
    if grep -En 'systemctl[[:space:]]+(enable|disable|start|stop|restart|reset-failed)|semanage[[:space:]]+(fcontext|port)[[:space:]]+-(a|m|d)|setfacl[[:space:]]+-m|chown|chgrp|chmod[[:space:]]+0?[0-7]{3}' "$SCRIPT_PATH" |
        grep -v 'grep -En'; then
        return 1
    fi
    if grep -En 'sha256sum[^\n]*(redis5\.password|redis7\.password)|cat[[:space:]]+[^\n]*(redis5\.password|redis7\.password)' "$SCRIPT_PATH" |
        grep -v 'grep -En'; then
        return 1
    fi
    printf '%s\n' \
        'Q132_ACTIVATION_READINESS_DIAG_STATIC_VALIDATE=PASS' \
        'SERVICE_AND_SELINUX_MUTATION=ZERO_REQUIRED' \
        'Q132_ACTIVATION=NOT_PERFORMED'
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then
    static_validate
    exit 0
fi
[[ $# -eq 0 ]]
[[ $(id -u) -eq 0 ]]
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]]
ip -o -4 addr show scope global | awk '{split($4,a,"/"); print a[1]}' | grep -Fxq "$EXPECTED_IP"
printf 'Q132_ACTIVATION_READINESS_TARGET_IDENTITY=PASS|host=%s|ip=%s\n' "$actual_host" "$EXPECTED_IP"

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"

printf '%s\n' '=== LOCKED PASS RECEIPTS ==='
[[ -f "$ENTRY" && ! -L "$ENTRY" && $(stat -c '%U:%G:%a' "$ENTRY") == root:root:750 ]]
printf '%s  %s\n' "$ENTRY_SHA256" "$ENTRY" | sha256sum -c -
for audit in "$OWNER_AUDIT" "$IMPORT_AUDIT"; do
    [[ -f "$audit" && ! -L "$audit" ]]
    stat -c 'AUDIT|%F|%A|%a|%U:%G|%s|%n' "$audit"
done
grep -Fxq 'Q132_PACKAGE_OWNER_REPAIR_V2=PASS_ROOT_ROOT_FIXED_MEMBERS' "$OWNER_AUDIT"
grep -Fxq 'Q132_PACKAGE_OWNER_REPAIR_AND_IMPORT_V2=PASS' "$OWNER_AUDIT"
grep -Fxq 'Q132_CANONICAL_SECRET_IMPORT=PASS' "$IMPORT_AUDIT"
grep -Fxq 'Q132_POST_IMPORT_READINESS=PASS' "$IMPORT_AUDIT"
printf 'Q132_IMPORT_PASS_RECEIPT_GATE=PASS\n'

printf '%s\n' '=== IDENTITY AND SECRET METADATA ==='
grep -Fxq 'ROLE=redis' /etc/zhct/node.env
grep -Fxq 'NODE_KEY=redis02' /etc/zhct/node.env
grep -Fxq 'NODE_IP=10.2.203.113' /etc/zhct/node.env
grep -Fxq 'NODE_NAME=sqjcredis02' /etc/zhct/node.env
grep -E '^(ROLE|NODE_KEY|NODE_IP|NODE_NAME|APPLIED_AT)=' /etc/zhct/node.env
for secret in /etc/zhct/secrets/redis5.password /etc/zhct/secrets/redis7.password; do
    [[ -f "$secret" && ! -L "$secret" && -s "$secret" ]]
    [[ $(stat -c '%U:%G:%a' "$secret") == root:root:600 ]]
    stat -c 'SECRET_METADATA|PRESENT|%F|%A|%a|%U:%G|%s|%n' "$secret"
done
printf 'Q132_SECRET_METADATA_GATE=PASS|values=NOT_OUTPUT_NOT_HASHED\n'

printf '%s\n' '=== CONFIG DAC AND PLACEHOLDER STATE ==='
for path in /etc /etc/redis /etc/redis/redis5.conf /etc/redis/redis7.conf; do
    stat -c 'DAC|%F|%A|%a|%U:%G|%s|%n' "$path"
    ls -Zd "$path"
done
getfacl -cp /etc /etc/redis 2>&1 | sed 's/^/ACL|/'
for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
    [[ -f "$config" && ! -L "$config" ]]
    [[ $(stat -c '%U:%G:%a' "$config") == root:redis:640 ]]
    awk '$1 ~ /^(bind|port|protected-mode|daemonize|dir|dbfilename|appendonly|appendfilename|appenddirname|replicaof|replica-read-only|maxmemory-policy)$/ {print "SAFE_CONFIG|" FILENAME "|" $0}' "$config"
done
if grep -Eq '__[A-Z0-9_]+__' /etc/redis/redis5.conf /etc/redis/redis7.conf; then
    printf 'REDIS_CONFIG_PLACEHOLDER=PRESENT_EXPECTED_BEFORE_ACTIVATION\n'
else
    printf 'REDIS_CONFIG_PLACEHOLDER=ABSENT_ALREADY_MATERIALIZED\n'
fi

printf '%s\n' '=== REDIS USER DAC PROBES ==='
dac_ready=1
for path in /etc /etc/redis; do
    if runuser -u redis -- test -x "$path"; then
        printf 'REDIS_USER_TRAVERSE|PASS|%s\n' "$path"
    else
        printf 'REDIS_USER_TRAVERSE|FAIL|%s\n' "$path"
        dac_ready=0
    fi
done
for config in /etc/redis/redis5.conf /etc/redis/redis7.conf; do
    if runuser -u redis -- test -r "$config"; then
        printf 'REDIS_USER_CONFIG_READ|PASS|%s\n' "$config"
    else
        printf 'REDIS_USER_CONFIG_READ|FAIL|%s\n' "$config"
        dac_ready=0
    fi
done

printf '%s\n' '=== SELINUX EXECUTABLE AND POLICY STATE ==='
printf 'SELINUX_MODE=%s\n' "$(getenforce)"
rpm -q policycoreutils-python-utils 2>&1 || true
selinux_ready=1
for path in /opt/redis/5.0.14/bin/redis-server /opt/redis/7.2.14/bin/redis-server; do
    stat -c 'EXECUTABLE|%F|%A|%a|%U:%G|context=%C|%n' "$path"
    if runuser -u redis -- "$path" --version >/dev/null 2>&1; then
        printf 'REDIS_USER_EXEC|PASS|%s\n' "$path"
    else
        printf 'REDIS_USER_EXEC|FAIL|%s\n' "$path"
        selinux_ready=0
    fi
    case "$(stat -c '%C' "$path")" in
        *:redis_exec_t:*) printf 'EXEC_CONTEXT|READY_REDIS_EXEC_T|%s\n' "$path" ;;
        *) printf 'EXEC_CONTEXT|REPAIR_REQUIRED|%s\n' "$path"; selinux_ready=0 ;;
    esac
done
if command -v semanage >/dev/null 2>&1; then
    semanage fcontext -l 2>&1 | grep -E '/opt/redis/(5\\\.0\\\.14|7\\\.2\\\.14)/bin|/etc/redis|/data/redis[57]|/var/log/redis[57]|/var/run/redis[57]' || true
    semanage port -l 2>&1 | grep -E '^redis_port_t[[:space:]]+tcp' || true
else
    printf 'SEMANAGE=ABSENT\n'
    selinux_ready=0
fi

printf '%s\n' '=== QUIET UNIT LISTENER STATE ==='
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
    enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)
    active=$(systemctl is-active "$unit" 2>/dev/null || true)
    printf 'UNIT|%s|enabled=%s|active=%s\n' "$unit" "$enabled" "$active"
    [[ "$enabled" == disabled && "$active" == inactive ]]
done
if ss -lntupH | grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)' >/dev/null; then
    printf 'TARGET_LISTENERS=PRESENT_UNEXPECTED\n'
    quiet_ready=0
else
    printf 'TARGET_LISTENERS=NONE\n'
    quiet_ready=1
fi
systemctl --failed --no-legend --plain || true

printf 'READINESS_COMPONENTS|dac=%s|selinux=%s|quiet=%s\n' "$dac_ready" "$selinux_ready" "$quiet_ready"
if [[ "$dac_ready" -eq 1 && "$selinux_ready" -eq 1 && "$quiet_ready" -eq 1 ]]; then
    printf 'Q132_ACTIVATION_GATE=PASS_DIRECT_EXECUTE_ELIGIBLE\n'
else
    printf 'Q132_ACTIVATION_GATE=BLOCKED_REQUIRES_CONTROLLED_SELINUX_OR_DAC_REPAIR\n'
fi
printf 'Q132_ACTIVATION_READINESS_DIAGNOSIS=PASS_READ_ONLY\n'
printf 'ACTIVATION=NOT_PERFORMED\n'