#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_OWNER_REPAIR_PREWRITE_DIAGNOSIS
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly PACKAGE_DIR=/root/redis-q131-q132-delivery-v2
readonly ENTRY="${PACKAGE_DIR}/redis-q131-q132"
readonly README="${PACKAGE_DIR}/README.md"
readonly SUMS="${PACKAGE_DIR}/SHA256SUMS"
readonly ENTRY_SHA256=d229ade533bbe22f66f174bbcfccf685b470f00c466a5286649710be14794f5e
readonly README_SHA256=bb5d5ea98437edbe56b8ec8eaf6bf0cabb944e0fb8f93472a47242903611b17e
readonly SUMS_SHA256=2369bb6d300ad6e87e6ee7901d36fd999f723791a01a4439eb153a7a2bcda9e7
readonly REPAIR_SCRIPT=/root/redis02-q132-package-owner-repair-and-import.sh
readonly REPAIR_SHA256=69e8017b8b3bdc24a98d2c3983d4f55454b8693dc9b3f9c1498e8825624df8cc
readonly IMPORT_SCRIPT=/root/redis02-q132-root-upload-secret-import.sh
readonly IMPORT_SHA256=3f00fa16621a3410b9814bdc80731da2e932af9d45065cb80c0b758b4ed24264
readonly DIAG_AUDIT=/var/backups/zhct-q132-import-diagnosis/q132-import-diagnosis-20260805T092943Z/operator.log
readonly FAILED_AUDIT=/var/backups/zhct-q132-owner-repair/q132-owner-repair-import-20260805T093836Z/operator.log
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-owner-prewrite-diagnosis-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q132-owner-prewrite-diagnosis/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"

finish() {
    local rc=$?
    trap - EXIT
    printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$LABEL" "$rc" "$AUDIT_LOG"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    [[ "$EXPECTED_HOST" == sqjcredis02 ]]
    [[ "$EXPECTED_IP" == 10.2.203.113 ]]
    ! grep -Eq 'systemctl[[:space:]]+(enable|disable|start|stop|restart)|chown|chmod[[:space:]]+0?[0-7]{3}' "$SCRIPT_PATH"
    ! grep -Eq 'sha256sum[^\n]*(redis5\.password|redis7\.password)' "$SCRIPT_PATH"
    printf '%s\n' \
        'Q132_OWNER_REPAIR_PREWRITE_DIAG_STATIC_VALIDATE=PASS' \
        'PACKAGE_AND_SERVICE_MUTATION=ZERO' \
        'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED'
}

gate() {
    local name=$1
    shift
    if "$@"; then
        printf 'GATE|%s|PASS\n' "$name"
    else
        printf 'GATE|%s|FAIL\n' "$name"
    fi
}

is_regular_nonsymlink() {
    [[ -f "$1" && ! -L "$1" ]]
}

sha_matches() {
    local expected=$1 path=$2
    [[ -f "$path" && ! -L "$path" ]] || return 1
    printf '%s  %s\n' "$expected" "$path" | sha256sum -c - >/dev/null
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then
    static_validate
    exit 0
fi
[[ $# -eq 0 ]]
[[ $(id -u) -eq 0 ]]
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]]
ip -o -4 addr show scope global | awk '{split($4,a,"/"); print a[1]}' | grep -Fxq "$EXPECTED_IP"
printf 'IDENTITY|hostname=%s|ip=%s|PASS\n' "$actual_host" "$EXPECTED_IP"

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"

printf '%s\n' '=== PACKAGE DIRECTORY AND MEMBERS ==='
if [[ -e "$PACKAGE_DIR" || -L "$PACKAGE_DIR" ]]; then
    stat -c 'PATH|%F|%A|%a|%U:%G|%s|%n' "$PACKAGE_DIR"
    find "$PACKAGE_DIR" -mindepth 1 -maxdepth 1 -printf 'MEMBER|%f|%y\n' | sort
else
    printf 'PATH|ABSENT|%s\n' "$PACKAGE_DIR"
fi
for path in "$README" "$SUMS" "$ENTRY"; do
    if [[ -e "$path" || -L "$path" ]]; then
        stat -c 'PATH|%F|%A|%a|%U:%G|%s|%n' "$path"
    else
        printf 'PATH|ABSENT|%s\n' "$path"
    fi
done

gate PACKAGE_DIR_REAL_DIRECTORY test -d "$PACKAGE_DIR"
gate PACKAGE_DIR_NOT_SYMLINK test ! -L "$PACKAGE_DIR"
gate PACKAGE_DIR_ROOT_OWNER test "$(stat -c '%U:%G' "$PACKAGE_DIR" 2>/dev/null || true)" = root:root
gate PACKAGE_DIR_MODE_700 test "$(stat -c '%a' "$PACKAGE_DIR" 2>/dev/null || true)" = 700
actual_members=$(find "$PACKAGE_DIR" -mindepth 1 -maxdepth 1 -printf '%f\n' 2>/dev/null | sort || true)
expected_members=$'README.md\nSHA256SUMS\nredis-q131-q132'
gate PACKAGE_EXACT_THREE_MEMBERS test "$actual_members" = "$expected_members"
gate README_REGULAR_NONSYMLINK is_regular_nonsymlink "$README"
gate SUMS_REGULAR_NONSYMLINK is_regular_nonsymlink "$SUMS"
gate ENTRY_REGULAR_NONSYMLINK is_regular_nonsymlink "$ENTRY"
gate README_SHA256 sha_matches "$README_SHA256" "$README"
gate SUMS_SHA256 sha_matches "$SUMS_SHA256" "$SUMS"
gate ENTRY_SHA256 sha_matches "$ENTRY_SHA256" "$ENTRY"

printf '%s\n' '=== FIXED SCRIPTS AND PRIOR AUDITS ==='
gate REPAIR_SCRIPT_SHA256 sha_matches "$REPAIR_SHA256" "$REPAIR_SCRIPT"
gate IMPORT_SCRIPT_ROOT_OWNER test "$(stat -c '%U:%G' "$IMPORT_SCRIPT" 2>/dev/null || true)" = root:root
gate IMPORT_SCRIPT_SHA256 sha_matches "$IMPORT_SHA256" "$IMPORT_SCRIPT"
gate DIAG_AUDIT_PRESENT is_regular_nonsymlink "$DIAG_AUDIT"
gate DIAG_AUDIT_OWNER_FAILURE grep -Fxq 'ENTRY_ROOT_OWNER_GATE=FAIL' "$DIAG_AUDIT"
gate DIAG_AUDIT_PASS_MARKER grep -Fxq 'Q132_IMPORT_FAILURE_DIAGNOSIS=PASS_READ_ONLY' "$DIAG_AUDIT"
gate DIAG_AUDIT_ZERO_MUTATION grep -Fxq 'SERVICE_MUTATION=ZERO' "$DIAG_AUDIT"
if [[ -e "$FAILED_AUDIT" || -L "$FAILED_AUDIT" ]]; then
    stat -c 'FAILED_AUDIT|PRESENT|%F|%A|%a|%U:%G|%s|%n' "$FAILED_AUDIT"
else
    printf 'FAILED_AUDIT|ABSENT_EXPECTED_FOR_PREWRITE_FAILURE|%s\n' "$FAILED_AUDIT"
fi

printf '%s\n' '=== UNIT AND LISTENER STATE ==='
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
    printf 'UNIT|%s|enabled=%s|active=%s\n' \
        "$unit" \
        "$(systemctl is-enabled "$unit" 2>/dev/null || true)" \
        "$(systemctl is-active "$unit" 2>/dev/null || true)"
done
if ss -lntH | awk '{print $4}' | grep -Eq ':(6379|6387|26379|26387|3000|10008)$'; then
    printf '%s\n' 'TARGET_LISTENERS=PRESENT'
else
    printf '%s\n' 'TARGET_LISTENERS=NONE'
fi
printf '%s\n' \
    'Q132_OWNER_REPAIR_PREWRITE_DIAGNOSIS=PASS_READ_ONLY' \
    'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED' \
    'PACKAGE_MUTATION=ZERO' \
    'SERVICE_MUTATION=ZERO'