#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_PACKAGE_OWNER_REPAIR_AND_IMPORT
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly PACKAGE_DIR=/root/redis-q131-q132-delivery-v2
readonly ENTRY="${PACKAGE_DIR}/redis-q131-q132"
readonly README="${PACKAGE_DIR}/README.md"
readonly SUMS="${PACKAGE_DIR}/SHA256SUMS"
readonly ENTRY_SHA256=d229ade533bbe22f66f174bbcfccf685b470f00c466a5286649710be14794f5e
readonly README_SHA256=bb5d5ea98437edbe56b8ec8eaf6bf0cabb944e0fb8f93472a47242903611b17e
readonly SUMS_SHA256=2369bb6d300ad6e87e6ee7901d36fd999f723791a01a4439eb153a7a2bcda9e7
readonly IMPORT_SCRIPT=/root/redis02-q132-root-upload-secret-import.sh
readonly IMPORT_SCRIPT_SHA256=3f00fa16621a3410b9814bdc80731da2e932af9d45065cb80c0b758b4ed24264
readonly DIAG_AUDIT=/var/backups/zhct-q132-import-diagnosis/q132-import-diagnosis-20260805T092943Z/operator.log
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-owner-repair-import-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q132-owner-repair/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"
owner_repaired=0
success=0

finish() {
    local rc=$?
    trap - EXIT
    if [[ "$rc" -ne 0 && "$owner_repaired" -eq 1 ]]; then
        printf '%s\n' \
            'Q132_PACKAGE_OWNER_REPAIR_ROLLBACK=NOT_REVERTED_ROOT_ROOT_IS_REQUIRED_INVARIANT' \
            'Q132_SECRET_IMPORT_ROLLBACK=DELEGATED_TO_LOCKED_IMPORT_SCRIPT'
    elif [[ "$success" -eq 1 ]]; then
        printf '%s\n' 'Q132_PACKAGE_OWNER_REPAIR_ROLLBACK=NOT_REQUIRED'
    else
        printf '%s\n' 'Q132_PACKAGE_OWNER_REPAIR_ROLLBACK=NOT_REQUIRED_NO_WRITE'
    fi
    printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$LABEL" "$rc" "${AUDIT_LOG:-NOT_CREATED}"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    [[ "$EXPECTED_HOST" == sqjcredis02 ]]
    [[ "$EXPECTED_IP" == 10.2.203.113 ]]
    [[ "$IMPORT_SCRIPT_SHA256" == 3f00fa16621a3410b9814bdc80731da2e932af9d45065cb80c0b758b4ed24264 ]]
    grep -Fq 'chown root:root -- "$README" "$SUMS" "$ENTRY"' "$SCRIPT_PATH"
    ! grep -Eq 'chown[[:space:]]+(-R|--recursive)' "$SCRIPT_PATH"
    ! grep -Eq 'systemctl[[:space:]]+(enable|start|restart|stop|disable)' "$SCRIPT_PATH"
    ! grep -Eq 'sha256sum[^\n]*(redis5\.password|redis7\.password)' "$SCRIPT_PATH"
    printf '%s\n' \
        'Q132_PACKAGE_OWNER_REPAIR_IMPORT_STATIC_VALIDATE=PASS' \
        'REPAIR_SCOPE=THREE_FIXED_NONSECRET_PACKAGE_FILES' \
        'SERVICE_ACTIVATION=PROHIBITED'
}

validate_regular_nonsymlink() {
    [[ -f "$1" && ! -L "$1" ]]
}

verify_package_content() {
    validate_regular_nonsymlink "$README"
    validate_regular_nonsymlink "$SUMS"
    validate_regular_nonsymlink "$ENTRY"
    printf '%s  %s\n' "$README_SHA256" "$README" | sha256sum -c -
    printf '%s  %s\n' "$SUMS_SHA256" "$SUMS" | sha256sum -c -
    printf '%s  %s\n' "$ENTRY_SHA256" "$ENTRY" | sha256sum -c -
    (cd "$PACKAGE_DIR" && sha256sum -c SHA256SUMS)
    bash -n "$ENTRY"
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then
    static_validate
    exit 0
fi
[[ $# -eq 0 ]]
[[ $(id -u) -eq 0 ]] || {
    echo 'ERROR: root is required; zero writes performed' >&2
    exit 1
}
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]] || {
    echo 'ERROR: wrong hostname; zero writes performed' >&2
    exit 1
}
ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Fxq "$EXPECTED_IP" || {
        echo 'ERROR: expected IP absent; zero writes performed' >&2
        exit 1
    }
printf 'IDENTITY|hostname=%s|ip=%s|PASS\n' "$actual_host" "$EXPECTED_IP"

[[ -d "$PACKAGE_DIR" && ! -L "$PACKAGE_DIR" ]]
[[ $(stat -c '%U:%G' "$PACKAGE_DIR") == root:root ]]
[[ $(stat -c '%a' "$PACKAGE_DIR") == 700 ]]
actual_members=$(find "$PACKAGE_DIR" -mindepth 1 -maxdepth 1 -printf '%f\n' | sort)
expected_members=$'README.md\nSHA256SUMS\nredis-q131-q132'
[[ "$actual_members" == "$expected_members" ]]
verify_package_content
validate_regular_nonsymlink "$IMPORT_SCRIPT"
[[ $(stat -c '%U:%G' "$IMPORT_SCRIPT") == root:root ]]
printf '%s  %s\n' "$IMPORT_SCRIPT_SHA256" "$IMPORT_SCRIPT" | sha256sum -c -
bash -n "$IMPORT_SCRIPT"
validate_regular_nonsymlink "$DIAG_AUDIT"
grep -Fxq 'ENTRY_ROOT_OWNER_GATE=FAIL' "$DIAG_AUDIT"
grep -Fxq 'Q132_IMPORT_FAILURE_DIAGNOSIS=PASS_READ_ONLY' "$DIAG_AUDIT"
grep -Fxq 'SERVICE_MUTATION=ZERO' "$DIAG_AUDIT"

printf '%s\n' '=== OWNER STATE BEFORE ==='
stat -c 'BEFORE|%F|%A|%a|%U:%G|%s|%n' "$PACKAGE_DIR" "$README" "$SUMS" "$ENTRY"
[[ $(stat -c '%U:%G' "$ENTRY") != root:root ]]
printf '%s\n' 'Q132_PACKAGE_OWNER_REPAIR_PREWRITE_GATE=PASS'

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
chown root:root -- "$README" "$SUMS" "$ENTRY"
owner_repaired=1
chmod 0640 "$README" "$SUMS"
chmod 0750 "$ENTRY"
printf '%s\n' '=== OWNER STATE AFTER ==='
stat -c 'AFTER|%F|%A|%a|%U:%G|%s|%n' "$PACKAGE_DIR" "$README" "$SUMS" "$ENTRY"
for path in "$README" "$SUMS" "$ENTRY"; do
    [[ $(stat -c '%U:%G' "$path") == root:root ]]
done
verify_package_content
printf '%s\n' 'Q132_PACKAGE_OWNER_REPAIR=PASS_ROOT_ROOT_FIXED_MEMBERS'

"$IMPORT_SCRIPT"
printf '%s\n' \
    'Q132_PACKAGE_OWNER_REPAIR_AND_IMPORT=PASS' \
    'POST_CLONE=NOT_PERFORMED' \
    'ACTIVATION=NOT_PERFORMED' \
    'SENTINEL5=DISABLED_INACTIVE' \
    'SENTINEL7=DISABLED_INACTIVE' \
    'ORCHESTRATOR=DISABLED_INACTIVE' \
    'VIP=DISABLED' \
    'CROSS_HOST_HA=NOT_ACCEPTED'
success=1