#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_PREFLIGHT_V2
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly ARCHIVE=/root/redis-q131-q132-delivery-v2.tar.gz
readonly ARCHIVE_SHA256=203f3ece059997a84cf2e257eec319827c4ef76782e8de5962de7aa331fb3e4e
readonly PACKAGE_DIR=/root/redis-q131-q132-delivery-v2
readonly ENTRY_SHA256=d229ade533bbe22f66f174bbcfccf685b470f00c466a5286649710be14794f5e
readonly Q131_PASS_SHA256=c4a0ef639ece14dfbe383465a9f3b5bbd4ecbb8e5e66d129830178b43adf9283
readonly BUNDLE_ROOT=/opt/zhct-deploy
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-preflight-v2-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q131-132/manual/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"

finish() {
    local rc=$?
    trap - EXIT
    printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$LABEL" "$rc" "${AUDIT_LOG:-NOT_CREATED}"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    test "$EXPECTED_HOST" = sqjcredis02
    test "$EXPECTED_IP" = 10.2.203.113
    test "$ARCHIVE_SHA256" = 203f3ece059997a84cf2e257eec319827c4ef76782e8de5962de7aa331fb3e4e
    test "$ENTRY_SHA256" = d229ade533bbe22f66f174bbcfccf685b470f00c466a5286649710be14794f5e
    test "$Q131_PASS_SHA256" = c4a0ef639ece14dfbe383465a9f3b5bbd4ecbb8e5e66d129830178b43adf9283
    grep -Fq 'q132 preflight' "$SCRIPT_PATH"
    ! grep -Eq '[[:space:]]q132[[:space:]]+(execute|verify|rollback|archive)([[:space:]]|$)' "$SCRIPT_PATH"
    ! grep -Eq 'systemctl[[:space:]]+(enable|start|restart|stop|disable)' "$SCRIPT_PATH"
    ! grep -Eq 'post-clone\.sh|activate-role\.sh|rollback-role\.sh' "$SCRIPT_PATH"
    printf '%s\n' \
        'Q132_PREFLIGHT_V2_STATIC_VALIDATE=PASS' \
        'REMOTE_SERVICE_MUTATION=PROHIBITED' \
        'SECRET_CONTENT=NOT_READ_NOT_OUTPUT_NOT_HASHED'
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"

if [[ "${1:-}" == --static-validate ]]; then
    static_validate
    exit 0
fi
[[ $# -eq 0 ]] || {
    echo 'ERROR: no arguments are accepted except --static-validate' >&2
    exit 64
}

[[ $(id -u) -eq 0 ]] || {
    echo 'ERROR: root is required' >&2
    exit 1
}
actual_host=$(hostname -s)
printf 'IDENTITY|hostname=%s|expected=%s\n' "$actual_host" "$EXPECTED_HOST"
[[ "$actual_host" == "$EXPECTED_HOST" ]] || {
    echo 'ERROR: wrong hostname; zero persistent writes performed' >&2
    exit 1
}
ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Fxq "$EXPECTED_IP" || {
        echo 'ERROR: expected target IP is absent; zero persistent writes performed' >&2
        exit 1
    }
printf 'IDENTITY|ip=%s|expected=%s\n' "$EXPECTED_IP" "$EXPECTED_IP"

[[ -f "$ARCHIVE" && ! -L "$ARCHIVE" ]] || {
    echo "ERROR: archive is absent or not a regular non-symlink file: $ARCHIVE" >&2
    exit 1
}
[[ $(stat -c '%U:%G' "$ARCHIVE") == root:root ]] || {
    echo 'ERROR: archive owner must be root:root' >&2
    exit 1
}
printf '%s  %s\n' "$ARCHIVE_SHA256" "$ARCHIVE" | sha256sum -c -
[[ ! -e "$PACKAGE_DIR" && ! -L "$PACKAGE_DIR" ]] || {
    echo "ERROR: package directory already exists; refuse overwrite: $PACKAGE_DIR" >&2
    exit 1
}

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
printf '%s\n' \
    "Q131_PASS_EVIDENCE_SHA256=$Q131_PASS_SHA256" \
    'Q131_PASS_CLASS=CONTROLLER_ACCEPTED_A_LEVEL_FULL_V3_AUDIT' \
    'Q132_REMOTE_SERVICE_MUTATION=ZERO_READONLY_PREFLIGHT'

install -d -o root -g root -m 0700 "$PACKAGE_DIR"
tar -xzf "$ARCHIVE" -C "$PACKAGE_DIR" --strip-components=1
cd "$PACKAGE_DIR"
sha256sum -c SHA256SUMS
[[ -x ./redis-q131-q132 ]]
printf '%s  %s\n' "$ENTRY_SHA256" ./redis-q131-q132 | sha256sum -c -
bash -n ./redis-q131-q132
./redis-q131-q132 --static-validate --bundle-root "$BUNDLE_ROOT"

for unit in sentinel5.service sentinel7.service orchestrator.service; do
    enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)
    active=$(systemctl is-active "$unit" 2>/dev/null || true)
    printf 'AUX_UNIT|%s|enabled=%s|active=%s\n' "$unit" "$enabled" "$active"
    [[ "$enabled" == disabled && "$active" == inactive ]]
done
if ss -lntH |
    awk '$4 ~ /:(26379|26387|3000|10008)$/ {found=1} END {exit !found}'
then
    echo 'ERROR: forbidden auxiliary listener exists' >&2
    exit 1
fi
if ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Eq '^10\.2\.203\.(115|116|117)$'
then
    echo 'ERROR: forbidden VIP is present' >&2
    exit 1
fi
printf '%s\n' 'AUX_LISTENERS=NONE' 'VIP=ABSENT'

./redis-q131-q132 q132 preflight \
    --q131-pass-sha "$Q131_PASS_SHA256" \
    --run-id "$RUN_ID"

readonly ROLE_EVIDENCE_DIR="/var/backups/zhct-q131-132/q132/${RUN_ID}"
for evidence_file in stdout-stderr.log execution-receipt.env result.env; do
    [[ -s "$ROLE_EVIDENCE_DIR/$evidence_file" ]]
    stat -c 'EVIDENCE|%A|%U:%G|%s|%n' "$ROLE_EVIDENCE_DIR/$evidence_file"
    sha256sum "$ROLE_EVIDENCE_DIR/$evidence_file"
done
printf '%s\n' \
    'Q132_PREFLIGHT_V2=PASS_READ_ONLY' \
    'POST_CLONE=NOT_PERFORMED' \
    'ACTIVATION=NOT_PERFORMED' \
    'SENTINEL5=DISABLED_INACTIVE' \
    'SENTINEL7=DISABLED_INACTIVE' \
    'ORCHESTRATOR=DISABLED_INACTIVE' \
    'VIP=DISABLED' \
    'CROSS_HOST_HA=NOT_ACCEPTED' \
    "EVIDENCE_DIR=$ROLE_EVIDENCE_DIR"