#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_ROOT_UPLOAD_SECRET_IMPORT
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly Q131_PASS_SHA256=c4a0ef639ece14dfbe383465a9f3b5bbd4ecbb8e5e66d129830178b43adf9283
readonly PREFLIGHT_RUN_ID=q132-preflight-v2-20260805T071630Z
readonly PREFLIGHT_DIR="/var/backups/zhct-q131-132/q132/${PREFLIGHT_RUN_ID}"
readonly PREFLIGHT_RECEIPT_SHA256=b26186fe9b7d23e76d22681de22f1007dce8bbe3005785abb02d75c22c0023e5
readonly PREFLIGHT_RESULT_SHA256=be33610df4e1dc0612e8e102cd7b3dff4ca6588c3ad4a95b5bdf229761f205bd
readonly ENTRY=/root/redis-q131-q132-delivery-v2/redis-q131-q132
readonly ENTRY_SHA256=d229ade533bbe22f66f174bbcfccf685b470f00c466a5286649710be14794f5e
readonly UPLOAD5=/root/redis5.password
readonly UPLOAD7=/root/redis7.password
readonly UPLOAD_RECEIPT=/root/SOURCE_RECEIPT.txt
readonly EXPECTED_SOURCE_HOST=sqjcnginx01
readonly EXPECTED_SOURCE_IP=10.2.203.102
readonly SOURCE_CONTRACT=Q101_NGINX01_CANONICAL
readonly EXPECTED_SOURCE_STAGING=/root/q131-secret-transfer/redis-from-nginx01
readonly STAGING_PARENT=/root/q132-secret-import
readonly STAGING_DIR=/root/q132-secret-import/from-nginx01
readonly TARGET_DIR=/etc/zhct/secrets
readonly TARGET5=/etc/zhct/secrets/redis5.password
readonly TARGET7=/etc/zhct/secrets/redis7.password
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-secret-import-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q132-secret-import/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"
tmp_stage=
tmp5=
tmp7=
staging_parent_created=0
staging_written=0
target_dir_created=0
target5_written=0
target7_written=0
success=0

cleanup_this_run() {
    set +e
    if [[ -n "$tmp5" && -e "$tmp5" ]]; then rm -f -- "$tmp5"; fi
    if [[ -n "$tmp7" && -e "$tmp7" ]]; then rm -f -- "$tmp7"; fi
    if [[ "$target5_written" -eq 1 ]]; then rm -f -- "$TARGET5"; fi
    if [[ "$target7_written" -eq 1 ]]; then rm -f -- "$TARGET7"; fi
    if [[ "$target_dir_created" -eq 1 ]]; then rmdir -- "$TARGET_DIR" 2>/dev/null || true; fi
    if [[ -n "$tmp_stage" && -d "$tmp_stage" ]]; then
        rm -f -- "$tmp_stage/redis5.password" "$tmp_stage/redis7.password" "$tmp_stage/SOURCE_RECEIPT.txt"
        rmdir -- "$tmp_stage" 2>/dev/null || true
    fi
    if [[ "$staging_written" -eq 1 && -d "$STAGING_DIR" ]]; then
        rm -f -- "$STAGING_DIR/redis5.password" "$STAGING_DIR/redis7.password" "$STAGING_DIR/SOURCE_RECEIPT.txt"
        rmdir -- "$STAGING_DIR" 2>/dev/null || true
    fi
    if [[ "$staging_parent_created" -eq 1 ]]; then rmdir -- "$STAGING_PARENT" 2>/dev/null || true; fi
}

finish() {
    local rc=$?
    trap - EXIT
    if [[ "$rc" -ne 0 ]]; then
        if [[ "$target5_written" -eq 1 || "$target7_written" -eq 1 ||
              "$target_dir_created" -eq 1 || "$staging_written" -eq 1 ||
              "$staging_parent_created" -eq 1 || -n "$tmp_stage" ||
              -n "$tmp5" || -n "$tmp7" ]]; then
            cleanup_this_run
            printf '%s\n' \
                'Q132_SECRET_IMPORT_ROLLBACK=THIS_RUN_TARGETS_AND_STAGING_REMOVED' \
                'Q132_ROOT_UPLOAD_SOURCES=RETAINED_FOR_RETRY'
        else
            printf '%s\n' \
                'Q132_SECRET_IMPORT_ROLLBACK=NOT_REQUIRED_ZERO_PERSISTENT_WRITE' \
                'Q132_ROOT_UPLOAD_SOURCES=UNTOUCHED'
        fi
    elif [[ "$success" -eq 1 ]]; then
        printf '%s\n' \
            'Q132_SECRET_IMPORT_ROLLBACK=NOT_REQUIRED' \
            'Q132_ROOT_UPLOAD_SOURCES=RETAINED' \
            "Q132_STAGING_RETAINED=$STAGING_DIR"
    else
        printf '%s\n' 'Q132_SECRET_IMPORT_ROLLBACK=NOT_REQUIRED_NO_PERSISTENT_WRITE'
    fi
    printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$LABEL" "$rc" "${AUDIT_LOG:-NOT_CREATED}"
    exit "$rc"
}
trap finish EXIT

safe_stat() {
    stat -c 'TYPE=%F MODE=%a OWNER=%U:%G SIZE=%s' -- "$1"
}

validate_regular_root_owned() {
    local file=$1
    [[ -f "$file" && ! -L "$file" ]]
    [[ $(stat -c '%U:%G' -- "$file") == root:root ]]
}

validate_secret_file() {
    local file=$1
    validate_regular_root_owned "$file"
    [[ -s "$file" ]]
    awk 'NR != 1 || length($0) == 0 {bad=1} END {exit (bad || NR != 1)}' "$file"
}

receipt_contract_gate() {
    local receipt=$1 file5=$2 file7=$3 size5 size7 expected5 expected7
    validate_regular_root_owned "$receipt"
    [[ -s "$receipt" ]]
    [[ $(awk 'END {print NR+0}' "$receipt") -eq 10 ]]
    grep -Fxq 'Q131_SOURCE_RECEIPT_VERSION=1' "$receipt"
    grep -Eq '^RUN_ID=q131-secret-export-[A-Za-z0-9._-]+$' "$receipt"
    grep -Eq '^CREATED_AT=[^[:space:]]+$' "$receipt"
    grep -Fxq "SOURCE_HOST=$EXPECTED_SOURCE_HOST" "$receipt"
    grep -Fxq "SOURCE_IP=$EXPECTED_SOURCE_IP" "$receipt"
    grep -Fxq "SOURCE_CONTRACT=$SOURCE_CONTRACT" "$receipt"
    grep -Fxq 'SECRET_VALUES=NOT_OUTPUT_NOT_LOGGED' "$receipt"
    grep -Fxq 'SECRET_CONTENT_SHA=NOT_CALCULATED' "$receipt"
    [[ $(grep -c '^TRANSFER_FILE=' "$receipt") -eq 2 ]]
    size5=$(wc -c <"$file5")
    size7=$(wc -c <"$file7")
    expected5="TRANSFER_FILE=redis5.password SOURCE=/etc/zhct/secrets/redis5.password STAGED=${EXPECTED_SOURCE_STAGING}/redis5.password OWNER=root:root MODE=600 SIZE=${size5}"
    expected7="TRANSFER_FILE=redis7.password SOURCE=/etc/zhct/secrets/redis7.password STAGED=${EXPECTED_SOURCE_STAGING}/redis7.password OWNER=root:root MODE=600 SIZE=${size7}"
    grep -Fxq "$expected5" "$receipt"
    grep -Fxq "$expected7" "$receipt"
}

static_validate() {
    bash -n "$SCRIPT_PATH"
    [[ "$EXPECTED_HOST" == sqjcredis02 ]]
    [[ "$EXPECTED_IP" == 10.2.203.113 ]]
    [[ "$Q131_PASS_SHA256" == c4a0ef639ece14dfbe383465a9f3b5bbd4ecbb8e5e66d129830178b43adf9283 ]]
    [[ "$PREFLIGHT_RECEIPT_SHA256" == b26186fe9b7d23e76d22681de22f1007dce8bbe3005785abb02d75c22c0023e5 ]]
    [[ "$PREFLIGHT_RESULT_SHA256" == be33610df4e1dc0612e8e102cd7b3dff4ca6588c3ad4a95b5bdf229761f205bd ]]
    grep -Fq 'q132 preflight' "$SCRIPT_PATH"
    ! grep -Eq '[[:space:]]q132[[:space:]]+(execute|verify|rollback|archive)([[:space:]]|$)' "$SCRIPT_PATH"
    ! grep -Eq 'systemctl[[:space:]]+(enable|start|restart|stop|disable)' "$SCRIPT_PATH"
    ! grep -Eq 'post-clone\.sh|activate-role\.sh|rollback-role\.sh' "$SCRIPT_PATH"
    printf '%s\n' \
        'Q132_SECRET_IMPORT_STATIC_VALIDATE=PASS' \
        'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED' \
        'ACTIVATION=PROHIBITED'
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then
    static_validate
    exit 0
fi
[[ $# -eq 0 ]] || {
    echo 'ERROR: no arguments are accepted except --static-validate' >&2
    exit 64
}

[[ $(id -u) -eq 0 ]] || {
    echo 'ERROR: root is required; zero persistent writes performed' >&2
    exit 1
}
actual_host=$(hostname -s)
printf 'IDENTITY|hostname=%s|expected=%s\n' "$actual_host" "$EXPECTED_HOST"
[[ "$actual_host" == "$EXPECTED_HOST" ]] || {
    echo 'ERROR: wrong hostname; zero persistent writes performed' >&2
    exit 1
}
ip -o -4 addr show scope global |
    awk '{split($4,a,"/"); print a[1]}' |
    grep -Fxq "$EXPECTED_IP" || {
        echo 'ERROR: expected target IP is absent; zero persistent writes performed' >&2
        exit 1
    }
printf 'IDENTITY|ip=%s|expected=%s\n' "$EXPECTED_IP" "$EXPECTED_IP"

validate_regular_root_owned "$ENTRY"
printf '%s  %s\n' "$ENTRY_SHA256" "$ENTRY" | sha256sum -c -
bash -n "$ENTRY"
for evidence_spec in \
    "$PREFLIGHT_RECEIPT_SHA256  $PREFLIGHT_DIR/execution-receipt.env" \
    "$PREFLIGHT_RESULT_SHA256  $PREFLIGHT_DIR/result.env"
do
    printf '%s\n' "$evidence_spec" | sha256sum -c -
done
validate_regular_root_owned "$PREFLIGHT_DIR/execution-receipt.env"
validate_regular_root_owned "$PREFLIGHT_DIR/result.env"
printf '%s\n' 'Q132_PREFLIGHT_PASS_RECEIPT_GATE=PASS'

validate_secret_file "$UPLOAD5"
validate_secret_file "$UPLOAD7"
receipt_contract_gate "$UPLOAD_RECEIPT" "$UPLOAD5" "$UPLOAD7"
printf 'ROOT_UPLOAD|redis5.password|%s|LINE_POLICY=ONE_NONEMPTY_LINE\n' "$(safe_stat "$UPLOAD5")"
printf 'ROOT_UPLOAD|redis7.password|%s|LINE_POLICY=ONE_NONEMPTY_LINE\n' "$(safe_stat "$UPLOAD7")"
printf 'ROOT_UPLOAD|SOURCE_RECEIPT.txt|%s|CONTRACT_V1=PASS\n' "$(safe_stat "$UPLOAD_RECEIPT")"
printf '%s\n' \
    'SECRET_VALUES=NOT_OUTPUT_NOT_LOGGED' \
    'SECRET_CONTENT_SHA=NOT_CALCULATED' \
    'Q132_ROOT_UPLOAD_SOURCE_GATE=PASS'

[[ ! -e "$STAGING_DIR" && ! -L "$STAGING_DIR" ]]
[[ ! -e "$TARGET5" && ! -L "$TARGET5" ]]
[[ ! -e "$TARGET7" && ! -L "$TARGET7" ]]
if [[ -e "$STAGING_PARENT" || -L "$STAGING_PARENT" ]]; then
    [[ -d "$STAGING_PARENT" && ! -L "$STAGING_PARENT" ]]
    [[ $(stat -c '%U:%G' "$STAGING_PARENT") == root:root ]]
    [[ $(stat -c '%a' "$STAGING_PARENT") == 700 ]]
fi
if [[ -e "$TARGET_DIR" || -L "$TARGET_DIR" ]]; then
    [[ -d "$TARGET_DIR" && ! -L "$TARGET_DIR" ]]
    [[ $(stat -c '%U:%G' "$TARGET_DIR") == root:root ]]
    [[ $(stat -c '%a' "$TARGET_DIR") == 700 ]]
fi
printf '%s\n' 'Q132_PREWRITE_STAGING_AND_TARGETS_ABSENT=PASS'

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
printf '%s\n' \
    "RUN_ID=$RUN_ID" \
    "PREFLIGHT_RUN_ID=$PREFLIGHT_RUN_ID" \
    "Q131_PASS_SHA256=$Q131_PASS_SHA256"

if [[ ! -d "$STAGING_PARENT" ]]; then
    install -d -o root -g root -m 0700 "$STAGING_PARENT"
    staging_parent_created=1
fi
tmp_stage=$(mktemp -d "$STAGING_PARENT/.from-nginx01.${RUN_ID}.XXXXXX")
chown root:root "$tmp_stage"
chmod 0700 "$tmp_stage"
install -o root -g root -m 0600 "$UPLOAD5" "$tmp_stage/redis5.password"
install -o root -g root -m 0600 "$UPLOAD7" "$tmp_stage/redis7.password"
install -o root -g root -m 0600 "$UPLOAD_RECEIPT" "$tmp_stage/SOURCE_RECEIPT.txt"
validate_secret_file "$tmp_stage/redis5.password"
validate_secret_file "$tmp_stage/redis7.password"
receipt_contract_gate "$tmp_stage/SOURCE_RECEIPT.txt" "$tmp_stage/redis5.password" "$tmp_stage/redis7.password"
mv -- "$tmp_stage" "$STAGING_DIR"
tmp_stage=
staging_written=1
printf '%s\n' 'Q132_STAGING_ATOMIC_INSTALL=PASS_ROOT_ROOT_0700_FILES_0600'

if [[ ! -d "$TARGET_DIR" ]]; then
    install -d -o root -g root -m 0700 "$TARGET_DIR"
    target_dir_created=1
fi
tmp5=$(mktemp "$TARGET_DIR/.redis5.password.XXXXXX")
tmp7=$(mktemp "$TARGET_DIR/.redis7.password.XXXXXX")
install -o root -g root -m 0600 "$STAGING_DIR/redis5.password" "$tmp5"
install -o root -g root -m 0600 "$STAGING_DIR/redis7.password" "$tmp7"
validate_secret_file "$tmp5"
validate_secret_file "$tmp7"
mv -- "$tmp5" "$TARGET5"
tmp5=
target5_written=1
mv -- "$tmp7" "$TARGET7"
tmp7=
target7_written=1
validate_secret_file "$TARGET5"
validate_secret_file "$TARGET7"
cmp -s "$STAGING_DIR/redis5.password" "$TARGET5"
cmp -s "$STAGING_DIR/redis7.password" "$TARGET7"
printf 'TARGET_FILE|redis5.password|%s|COPY_MATCH=PASS\n' "$(safe_stat "$TARGET5")"
printf 'TARGET_FILE|redis7.password|%s|COPY_MATCH=PASS\n' "$(safe_stat "$TARGET7")"
printf '%s\n' \
    'Q132_CANONICAL_SECRET_IMPORT_METADATA=PASS' \
    'SECRET_VALUES=NOT_OUTPUT_NOT_LOGGED' \
    'SECRET_CONTENT_SHA=NOT_CALCULATED'

"$ENTRY" q132 preflight \
    --q131-pass-sha "$Q131_PASS_SHA256" \
    --run-id "${RUN_ID}-post-import-readiness"
printf '%s\n' \
    'Q132_POST_IMPORT_READINESS=PASS' \
    'POST_CLONE=NOT_PERFORMED' \
    'ACTIVATION=NOT_PERFORMED' \
    'SENTINEL5=DISABLED_INACTIVE' \
    'SENTINEL7=DISABLED_INACTIVE' \
    'ORCHESTRATOR=DISABLED_INACTIVE' \
    'VIP=DISABLED' \
    'CROSS_HOST_HA=NOT_ACCEPTED' \
    'Q132_CANONICAL_SECRET_IMPORT=PASS'
success=1