#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

LABEL=REDIS02_Q132_STATIC_PREFLIGHT
EXPECTED_HOST=sqjcredis02
EXPECTED_IP=10.2.203.113
PACKAGE_SHA=6cbf051f83d6b989bb88d33cc47d1b4e4027653809e5bbf9ae6402b3762d9651
ARCHIVE=/root/redis-q131-q132-delivery.tar.gz
PACKAGE_DIR=/root/redis-q131-q132-delivery
Q131_PASS_SHA_FILE=/root/q131-pass-receipt.sha256
RUN_ID="q132-preflight-upload-$(date +%Y%m%dT%H%M%S%z)"
AUDIT_DIR="/var/backups/zhct-manual-preflight/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"

finish() {
    rc=$?
    trap - EXIT
    printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$LABEL" "$rc" "${AUDIT_LOG:-NOT_CREATED}"
    exit "$rc"
}
trap finish EXIT

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date --iso-8601=seconds)"
actual_host=$(hostname -s)
printf 'IDENTITY|hostname=%s|expected=%s\n' "$actual_host" "$EXPECTED_HOST"
test "$actual_host" = "$EXPECTED_HOST"
ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Fxq "$EXPECTED_IP"

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date --iso-8601=seconds)"

if [[ ! -f "$Q131_PASS_SHA_FILE" ]]; then
    echo "BLOCKED|Q131_PASS_RECEIPT_SHA_FILE_REQUIRED|$Q131_PASS_SHA_FILE"
    exit 3
fi
test "$(stat -c %U:%G "$Q131_PASS_SHA_FILE")" = root:root
case "$(stat -c %a "$Q131_PASS_SHA_FILE")" in
    400|600) ;;
    *)
        echo 'BLOCKED|Q131_PASS_RECEIPT_SHA_FILE_MODE_MUST_BE_0400_OR_0600'
        exit 3
        ;;
esac
test "$(wc -l <"$Q131_PASS_SHA_FILE")" -eq 1
Q131_PASS_SHA=$(tr -d '\r\n' <"$Q131_PASS_SHA_FILE")
[[ "$Q131_PASS_SHA" =~ ^[0-9a-f]{64}$ ]] || {
    echo 'BLOCKED|Q131_PASS_RECEIPT_SHA_INVALID'
    exit 3
}

test -f "$ARCHIVE"
printf '%s  %s\n' "$PACKAGE_SHA" "$ARCHIVE" | sha256sum -c -
test ! -e "$PACKAGE_DIR"
tar -xzf "$ARCHIVE" -C /root
cd "$PACKAGE_DIR"
sha256sum -c SHA256SUMS
test -x ./redis-q131-q132
bash -n ./redis-q131-q132
./redis-q131-q132 --static-validate --bundle-root /opt/zhct-deploy

for unit in sentinel5 sentinel7 orchestrator; do
    test "$(systemctl is-enabled "$unit.service" 2>/dev/null || true)" = disabled
    test "$(systemctl is-active "$unit.service" 2>/dev/null || true)" = inactive
done
if ss -lntH |
    awk '$4 ~ /:(26379|26387|3000|10008)$/ {found=1} END {exit !found}'
then
    echo 'ERROR: forbidden auxiliary listener exists'
    exit 1
fi
if ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Eq '^10\.2\.203\.(115|116|117)$'
then
    echo 'ERROR: VIP is present'
    exit 1
fi

./redis-q131-q132 q132 preflight \
    --q131-pass-sha "$Q131_PASS_SHA" \
    --run-id "$RUN_ID"
EVIDENCE_DIR="/var/backups/zhct-q131-132/q132/${RUN_ID}"
sha256sum \
    "$EVIDENCE_DIR/stdout-stderr.log" \
    "$EVIDENCE_DIR/execution-receipt.env" \
    "$EVIDENCE_DIR/result.env"
printf '%s\n' \
    'EXPECTED|Q131_Q132_STATIC_VALIDATE=PASS' \
    'EXPECTED|Q132_PREFLIGHT=PASS' \
    'POLICY|sentinel5=disabled/inactive' \
    'POLICY|sentinel7=disabled/inactive' \
    'POLICY|orchestrator=disabled/inactive' \
    'POLICY|vip=absent' \
    "EVIDENCE_DIR=$EVIDENCE_DIR"