#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_IMPORT_FAILURE_DIAGNOSIS
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly IMPORT_SCRIPT=/root/redis02-q132-root-upload-secret-import.sh
readonly IMPORT_SCRIPT_SHA256=3f00fa16621a3410b9814bdc80731da2e932af9d45065cb80c0b758b4ed24264
readonly ENTRY=/root/redis-q131-q132-delivery-v2/redis-q131-q132
readonly ENTRY_SHA256=d229ade533bbe22f66f174bbcfccf685b470f00c466a5286649710be14794f5e
readonly PREFLIGHT_DIR=/var/backups/zhct-q131-132/q132/q132-preflight-v2-20260805T071630Z
readonly PREFLIGHT_RECEIPT_SHA256=b26186fe9b7d23e76d22681de22f1007dce8bbe3005785abb02d75c22c0023e5
readonly PREFLIGHT_RESULT_SHA256=be33610df4e1dc0612e8e102cd7b3dff4ca6588c3ad4a95b5bdf229761f205bd
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-import-diagnosis-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q132-import-diagnosis/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"

finish() {
    local rc=$?
    trap - EXIT
    printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$LABEL" "$rc" "${AUDIT_LOG:-NOT_CREATED}"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    [[ "$EXPECTED_HOST" == sqjcredis02 ]]
    [[ "$EXPECTED_IP" == 10.2.203.113 ]]
    ! grep -Eq 'systemctl[[:space:]]+(enable|start|restart|stop|disable)' "$SCRIPT_PATH"
    ! grep -Eq 'sha256sum[^\n]*(redis5\.password|redis7\.password)' "$SCRIPT_PATH"
    printf '%s\n' 'Q132_IMPORT_FAILURE_DIAGNOSIS_STATIC_VALIDATE=PASS'
}

describe_path() {
    local path=$1
    if [[ -e "$path" || -L "$path" ]]; then
        stat -c 'PATH|PRESENT|%F|%A|%a|%U:%G|%s|%n' -- "$path"
    else
        printf 'PATH|ABSENT|%s\n' "$path"
    fi
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then
    static_validate
    exit 0
fi
[[ $# -eq 0 ]]
[[ $(id -u) -eq 0 ]] || {
    echo 'ERROR: root is required; zero writes performed' >&2
    exit 1
}
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]] || {
    echo 'ERROR: wrong hostname; zero writes performed' >&2
    exit 1
}
ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Fxq "$EXPECTED_IP" || {
        echo 'ERROR: expected IP absent; zero writes performed' >&2
        exit 1
    }
printf 'IDENTITY|hostname=%s|ip=%s|PASS\n' "$actual_host" "$EXPECTED_IP"

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"

printf '%s\n' '=== IMPORT AND ENTRY ==='
describe_path "$IMPORT_SCRIPT"
describe_path "$(dirname "$ENTRY")"
describe_path "$ENTRY"
if [[ -f "$IMPORT_SCRIPT" && ! -L "$IMPORT_SCRIPT" ]]; then
    printf '%s  %s\n' "$IMPORT_SCRIPT_SHA256" "$IMPORT_SCRIPT" | sha256sum -c - || true
fi
if [[ -f "$ENTRY" && ! -L "$ENTRY" ]]; then
    printf '%s  %s\n' "$ENTRY_SHA256" "$ENTRY" | sha256sum -c - || true
    if [[ $(stat -c '%U:%G' "$ENTRY") == root:root ]]; then
        echo 'ENTRY_ROOT_OWNER_GATE=PASS'
    else
        echo 'ENTRY_ROOT_OWNER_GATE=FAIL'
    fi
else
    echo 'ENTRY_REGULAR_NONSYMLINK_GATE=FAIL'
fi

printf '%s\n' '=== PREFLIGHT RECEIPTS ==='
describe_path "$PREFLIGHT_DIR/execution-receipt.env"
describe_path "$PREFLIGHT_DIR/result.env"
if [[ -f "$PREFLIGHT_DIR/execution-receipt.env" && ! -L "$PREFLIGHT_DIR/execution-receipt.env" ]]; then
    printf '%s  %s\n' "$PREFLIGHT_RECEIPT_SHA256" "$PREFLIGHT_DIR/execution-receipt.env" | sha256sum -c - || true
fi
if [[ -f "$PREFLIGHT_DIR/result.env" && ! -L "$PREFLIGHT_DIR/result.env" ]]; then
    printf '%s  %s\n' "$PREFLIGHT_RESULT_SHA256" "$PREFLIGHT_DIR/result.env" | sha256sum -c - || true
fi

printf '%s\n' '=== ROOT UPLOAD METADATA ONLY ==='
for path in /root/redis5.password /root/redis7.password /root/SOURCE_RECEIPT.txt; do
    describe_path "$path"
done
printf '%s\n' \
    'SECRET_VALUES=NOT_OUTPUT_NOT_LOGGED' \
    'SECRET_CONTENT_SHA=NOT_CALCULATED'

printf '%s\n' '=== TARGET AND STAGING ==='
for path in /root/q132-secret-import /root/q132-secret-import/from-nginx01 \
    /etc/zhct/secrets /etc/zhct/secrets/redis5.password /etc/zhct/secrets/redis7.password
do
    describe_path "$path"
done

printf '%s\n' '=== UNIT AND LISTENER STATE ==='
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
    printf 'UNIT|%s|enabled=%s|active=%s\n' "$unit" \
        "$(systemctl is-enabled "$unit" 2>/dev/null || true)" \
        "$(systemctl is-active "$unit" 2>/dev/null || true)"
done
ss -lntupH | grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)' || echo 'TARGET_LISTENERS=NONE'
printf '%s\n' \
    'Q132_IMPORT_FAILURE_DIAGNOSIS=PASS_READ_ONLY' \
    'SERVICE_MUTATION=ZERO' \
    'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED'