#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_REPLICATION_NETWORK_DIAGNOSIS
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly PRIMARY_IP=10.2.203.112
readonly FAILED_AUDIT=/var/backups/zhct-q132-selinux-acl-activate/q132-selinux-acl-activate-20260806T021608Z/operator.log
readonly FAILED_WRAPPER_AUDIT=/var/backups/zhct-q132-offline-semanage-resume/q132-offline-semanage-resume-20260806T021604Z/operator.log
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-replication-network-diagnosis-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q132-replication-network-diagnosis/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"

finish() {
    local rc=$?
    set +e
    if [[ "$rc" -eq 0 ]]; then
        printf '%s\n' 'Q132_REPLICATION_NETWORK_DIAGNOSIS=PASS_READ_ONLY'
    else
        printf '%s\n' 'Q132_REPLICATION_NETWORK_DIAGNOSIS=FAIL_STOP'
    fi
    printf '%s\n' \
        'PACKAGE_MUTATION=ZERO' \
        'SERVICE_MUTATION=ZERO' \
        'FIREWALL_ROUTE_MUTATION=ZERO' \
        'SECRET_VALUES=NOT_READ_NOT_OUTPUT_NOT_HASHED' \
        "END|${LABEL}|RC=${rc}|AUDIT_LOG=${AUDIT_LOG}"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    if grep -En 'systemctl[[:space:]]+(start|stop|restart|enable|disable)|firewall-cmd[^\n]*(--add|--remove|--reload)|nft[[:space:]]+(add|delete|flush)|iptables[^\n]*-[AI]|ip[[:space:]]+(route|rule|addr)[[:space:]]+(add|del|replace)|dnf[[:space:]]+(-y|install|remove)|redis-cli' "$SCRIPT_PATH" |
        grep -v 'grep -En'; then
        return 1
    fi
    printf '%s\n' \
        'Q132_REPLICATION_NETWORK_DIAG_STATIC_VALIDATE=PASS' \
        'NETWORK_PROBES=TCP_CONNECT_ONLY' \
        'REMOTE_REDIS_COMMANDS=PROHIBITED' \
        'MUTATION=ZERO'
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then
    static_validate
    exit 0
fi

[[ $# -eq 0 ]]
[[ $(id -u) -eq 0 ]]
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]]
ip -o -4 addr show scope global | awk '{split($4,a,"/"); print a[1]}' | grep -Fxq "$EXPECTED_IP"
printf 'Q132_NETWORK_DIAG_TARGET_IDENTITY=PASS|host=%s|ip=%s\n' "$actual_host" "$EXPECTED_IP"

for command_name in ip ss timeout systemctl stat grep awk install tee; do
    command -v "$command_name" >/dev/null 2>&1 || {
        printf 'ERROR: required command is missing: %s\n' "$command_name" >&2
        exit 1
    }
done

[[ -f "$FAILED_AUDIT" && ! -L "$FAILED_AUDIT" ]]
[[ -f "$FAILED_WRAPPER_AUDIT" && ! -L "$FAILED_WRAPPER_AUDIT" ]]
grep -Fq 'Error condition on socket for SYNC: No route to host' "$FAILED_AUDIT"
grep -Fq 'Q132_ACTIVATION_ROLLBACK=PASS_IDENTITY_RETAINED' "$FAILED_AUDIT"
grep -Fq 'Q132_ONE_STEP_REPAIR_ACTIVATE_V2=FAIL_STOP' "$FAILED_WRAPPER_AUDIT"
printf 'Q132_FAILED_ACTIVATION_AUDIT_GATE=PASS|failure=REPLICATION_NETWORK_NO_ROUTE\n'

for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
    [[ "$(systemctl is-active "$unit" 2>/dev/null || true)" == inactive ]]
done
if ss -lntupH | grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)'; then
    printf 'ERROR: target listener is unexpectedly present; refuse diagnosis baseline\n' >&2
    exit 1
fi
printf 'Q132_SAFE_QUIET_BASELINE=PASS\n'

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"

printf '%s\n' '=== ADDRESS / ROUTE / RULE ==='
ip -br -4 addr show
ip -4 route show table all
ip -4 rule show
printf 'ROUTE_GET|'
ip -4 route get "$PRIMARY_IP" 2>&1 || true

printf '%s\n' '=== NEIGHBOR ==='
ip neigh show to "$PRIMARY_IP" 2>&1 || true

printf '%s\n' '=== TCP CONNECTIVITY TO REDIS01 ==='
tcp_pass=1
for port in 22 6379 6387; do
    set +e
    timeout 5 bash -c "exec 3<>/dev/tcp/${PRIMARY_IP}/${port}" >/dev/null 2>&1
    rc=$?
    set -e
    printf 'TCP_CONNECT|target=%s|port=%s|rc=%s|%s\n' "$PRIMARY_IP" "$port" "$rc" \
        "$([[ "$rc" -eq 0 ]] && printf PASS || printf FAIL)"
    if [[ "$port" != 22 && "$rc" -ne 0 ]]; then tcp_pass=0; fi
done

printf '%s\n' '=== LOCAL FIREWALL READ-ONLY ==='
printf 'FIREWALLD_ACTIVE=%s\n' "$(systemctl is-active firewalld.service 2>/dev/null || true)"
if command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --get-active-zones 2>&1 || true
    firewall-cmd --list-all-zones 2>&1 || true
fi
if command -v nft >/dev/null 2>&1; then
    nft list ruleset 2>&1 | grep -Ei -C 2 'reject|drop|6379|6387|10\.2\.203\.(112|113)' || true
fi

printf '%s\n' '=== ROLE QUIET STATE ==='
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
    printf 'UNIT|%s|enabled=%s|active=%s\n' "$unit" \
        "$(systemctl is-enabled "$unit" 2>/dev/null || true)" \
        "$(systemctl is-active "$unit" 2>/dev/null || true)"
done
printf 'TARGET_LISTENERS=NONE\n'

if [[ "$tcp_pass" -eq 1 ]]; then
    printf 'Q132_REPLICATION_TCP_GATE=PASS|redis01_ports=6379,6387\n'
    printf 'NEXT_ACTION=RETRY_CONTROLLED_Q132_ACTIVATION_WITH_LOCKED_RECEIPTS\n'
else
    printf 'Q132_REPLICATION_TCP_GATE=BLOCKED|redis01_ports=6379,6387\n'
    printf 'NEXT_ACTION=Q200_NETWORK_FIREWALL_PATH_REMEDIATION_REQUIRED_BEFORE_Q132_RETRY\n'
fi