#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_PACKAGE_OWNER_REPAIR_AND_IMPORT_V2
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly PACKAGE_DIR=/root/redis-q131-q132-delivery-v2
readonly ENTRY="${PACKAGE_DIR}/redis-q131-q132"
readonly README="${PACKAGE_DIR}/README.md"
readonly SUMS="${PACKAGE_DIR}/SHA256SUMS"
readonly ENTRY_SHA256=d229ade533bbe22f66f174bbcfccf685b470f00c466a5286649710be14794f5e
readonly README_SHA256=bb5d5ea98437edbe56b8ec8eaf6bf0cabb944e0fb8f93472a47242903611b17e
readonly SUMS_SHA256=2369bb6d300ad6e87e6ee7901d36fd999f723791a01a4439eb153a7a2bcda9e7
readonly IMPORT_SCRIPT=/root/redis02-q132-root-upload-secret-import.sh
readonly IMPORT_SCRIPT_SHA256=3f00fa16621a3410b9814bdc80731da2e932af9d45065cb80c0b758b4ed24264
readonly V1_SCRIPT=/root/redis02-q132-package-owner-repair-and-import.sh
readonly V1_SCRIPT_SHA256=69e8017b8b3bdc24a98d2c3983d4f55454b8693dc9b3f9c1498e8825624df8cc
readonly DIAG_SCRIPT=/root/redis02-q132-owner-repair-prewrite-diagnosis.sh
readonly DIAG_SCRIPT_SHA256=4c67d777aeb15f0583be26860c622a6569a711192c9aa97cd34c3e826b2a1fe3
readonly DIAG_AUDIT=/var/backups/zhct-q132-owner-prewrite-diagnosis/q132-owner-prewrite-diagnosis-20260805T095253Z/operator.log
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-owner-repair-v2-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q132-owner-repair-v2/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"
owner_repaired=0
success=0

die() {
    printf 'ERROR: %s\n' "$*" >&2
    return 1
}

finish() {
    local rc=$?
    trap - EXIT
    if [[ "$rc" -ne 0 && "$owner_repaired" -eq 1 ]]; then
        printf '%s\n' \
            'Q132_PACKAGE_OWNER_REPAIR_V2_ROLLBACK=NOT_REVERTED_ROOT_ROOT_IS_REQUIRED_INVARIANT' \
            'Q132_SECRET_IMPORT_ROLLBACK=DELEGATED_TO_LOCKED_IMPORT_SCRIPT'
    elif [[ "$success" -eq 1 ]]; then
        printf '%s\n' 'Q132_PACKAGE_OWNER_REPAIR_V2_ROLLBACK=NOT_REQUIRED'
    else
        printf '%s\n' 'Q132_PACKAGE_OWNER_REPAIR_V2_ROLLBACK=NOT_REQUIRED_NO_WRITE'
    fi
    printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$LABEL" "$rc" "$AUDIT_LOG"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    [[ "$EXPECTED_HOST" == sqjcredis02 ]]
    [[ "$EXPECTED_IP" == 10.2.203.113 ]]
    grep -Fq 'member_count=$(find "$PACKAGE_DIR" -mindepth 1 -maxdepth 1 -printf' "$SCRIPT_PATH"
    grep -Fq '[[ "$member_count" -eq 3 ]]' "$SCRIPT_PATH"
    grep -Fq 'chown root:root -- "$README" "$SUMS" "$ENTRY"' "$SCRIPT_PATH"
    if grep -En 'chown[[:space:]]+(-R|--recursive)|systemctl[[:space:]]+(enable|disable|start|stop|restart)' "$SCRIPT_PATH" |
        grep -v 'grep -En'; then
        die 'forbidden recursive ownership or service action found'
    fi
    if grep -En 'sha256sum[^\n]*(redis5\.password|redis7\.password)' "$SCRIPT_PATH" |
        grep -v 'grep -En'; then
        die 'forbidden secret digest found'
    fi
    printf '%s\n' \
        'Q132_PACKAGE_OWNER_REPAIR_V2_STATIC_VALIDATE=PASS' \
        'MEMBER_GATE=ORDER_INDEPENDENT_EXACT_THREE_FIXED_FILES' \
        'SERVICE_ACTIVATION=PROHIBITED'
}

regular_nonsymlink() {
    [[ -f "$1" && ! -L "$1" ]]
}

verify_package_content() {
    regular_nonsymlink "$README"
    regular_nonsymlink "$SUMS"
    regular_nonsymlink "$ENTRY"
    printf '%s  %s\n' "$README_SHA256" "$README" | sha256sum -c -
    printf '%s  %s\n' "$SUMS_SHA256" "$SUMS" | sha256sum -c -
    printf '%s  %s\n' "$ENTRY_SHA256" "$ENTRY" | sha256sum -c -
    (cd "$PACKAGE_DIR" && sha256sum -c SHA256SUMS)
    bash -n "$ENTRY"
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then
    static_validate
    exit 0
fi
[[ $# -eq 0 ]]
[[ $(id -u) -eq 0 ]] || die 'root is required; zero writes performed'
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]] || die 'wrong hostname; zero writes performed'
ip -o -4 addr show scope global | awk '{split($4,a,"/"); print a[1]}' | grep -Fxq "$EXPECTED_IP" ||
    die 'expected IP absent; zero writes performed'
printf 'IDENTITY|hostname=%s|ip=%s|PASS\n' "$actual_host" "$EXPECTED_IP"

[[ -d "$PACKAGE_DIR" && ! -L "$PACKAGE_DIR" ]]
[[ $(stat -c '%U:%G' "$PACKAGE_DIR") == root:root ]]
[[ $(stat -c '%a' "$PACKAGE_DIR") == 700 ]]
member_count=$(find "$PACKAGE_DIR" -mindepth 1 -maxdepth 1 -printf '.\n' | wc -l)
[[ "$member_count" -eq 3 ]]
verify_package_content
printf 'Q132_PACKAGE_MEMBER_GATE=PASS_ORDER_INDEPENDENT_EXACT_THREE\n'

regular_nonsymlink "$IMPORT_SCRIPT"
[[ $(stat -c '%U:%G' "$IMPORT_SCRIPT") == root:root ]]
printf '%s  %s\n' "$IMPORT_SCRIPT_SHA256" "$IMPORT_SCRIPT" | sha256sum -c -
bash -n "$IMPORT_SCRIPT"
regular_nonsymlink "$V1_SCRIPT"
printf '%s  %s\n' "$V1_SCRIPT_SHA256" "$V1_SCRIPT" | sha256sum -c -
regular_nonsymlink "$DIAG_SCRIPT"
printf '%s  %s\n' "$DIAG_SCRIPT_SHA256" "$DIAG_SCRIPT" | sha256sum -c -
regular_nonsymlink "$DIAG_AUDIT"
grep -Fxq 'GATE|PACKAGE_EXACT_THREE_MEMBERS|FAIL' "$DIAG_AUDIT"
grep -Fxq 'GATE|README_SHA256|PASS' "$DIAG_AUDIT"
grep -Fxq 'GATE|SUMS_SHA256|PASS' "$DIAG_AUDIT"
grep -Fxq 'GATE|ENTRY_SHA256|PASS' "$DIAG_AUDIT"
grep -Fxq 'Q132_OWNER_REPAIR_PREWRITE_DIAGNOSIS=PASS_READ_ONLY' "$DIAG_AUDIT"
grep -Fxq 'PACKAGE_MUTATION=ZERO' "$DIAG_AUDIT"
grep -Fxq 'SERVICE_MUTATION=ZERO' "$DIAG_AUDIT"

printf '%s\n' '=== OWNER STATE BEFORE ==='
stat -c 'BEFORE|%F|%A|%a|%U:%G|%s|%n' "$PACKAGE_DIR" "$README" "$SUMS" "$ENTRY"
for path in "$README" "$SUMS" "$ENTRY"; do
    [[ $(stat -c '%U:%G' "$path") != root:root ]]
done
printf 'Q132_PACKAGE_OWNER_REPAIR_V2_PREWRITE_GATE=PASS\n'

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
chown root:root -- "$README" "$SUMS" "$ENTRY"
owner_repaired=1
chmod 0640 "$README" "$SUMS"
chmod 0750 "$ENTRY"
printf '%s\n' '=== OWNER STATE AFTER ==='
stat -c 'AFTER|%F|%A|%a|%U:%G|%s|%n' "$PACKAGE_DIR" "$README" "$SUMS" "$ENTRY"
for path in "$README" "$SUMS" "$ENTRY"; do
    [[ $(stat -c '%U:%G' "$path") == root:root ]]
done
verify_package_content
printf 'Q132_PACKAGE_OWNER_REPAIR_V2=PASS_ROOT_ROOT_FIXED_MEMBERS\n'

"$IMPORT_SCRIPT"
printf '%s\n' \
    'Q132_PACKAGE_OWNER_REPAIR_AND_IMPORT_V2=PASS' \
    'POST_CLONE=NOT_PERFORMED' \
    'ACTIVATION=NOT_PERFORMED' \
    'SENTINEL5=DISABLED_INACTIVE' \
    'SENTINEL7=DISABLED_INACTIVE' \
    'ORCHESTRATOR=DISABLED_INACTIVE' \
    'VIP=DISABLED' \
    'CROSS_HOST_HA=NOT_ACCEPTED'
success=1