#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS02_Q132_SEMANAGE_CACHE_READINESS_DIAGNOSIS
readonly EXPECTED_HOST=sqjcredis02
readonly EXPECTED_IP=10.2.203.113
readonly SUPPORT_PACKAGE=policycoreutils-python-utils
readonly FAILED_SCRIPT=/root/redis02-q132-selinux-acl-repair-activate-verify.sh
readonly FAILED_SCRIPT_SHA256=5ebb623df5246c868960ac962527a7b2f015a1cf1ae04707a208acade60599af
readonly FAILED_AUDIT=/var/backups/zhct-q132-selinux-acl-activate/q132-selinux-acl-activate-20260806T013430Z/operator.log
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"
RUN_ID="q132-semanage-cache-diagnosis-$(date -u +%Y%m%dT%H%M%SZ)"
AUDIT_DIR="/var/backups/zhct-q132-semanage-cache-diagnosis/${RUN_ID}"
AUDIT_LOG="${AUDIT_DIR}/operator.log"

finish() {
    local rc=$?
    set +e
    if [[ "$rc" -eq 0 ]]; then
        printf '%s\n' 'Q132_SEMANAGE_CACHE_DIAGNOSIS=PASS_READ_ONLY'
    else
        printf '%s\n' 'Q132_SEMANAGE_CACHE_DIAGNOSIS=FAIL_STOP'
    fi
    printf '%s\n' \
        'PACKAGE_INSTALL=NOT_PERFORMED' \
        'ROLE_ACTIVATION=NOT_PERFORMED' \
        'SECRET_VALUES=NOT_READ_NOT_OUTPUT_NOT_HASHED' \
        'SERVICE_MUTATION=ZERO' \
        'SELINUX_ACL_MUTATION=ZERO' \
        "END|${LABEL}|RC=${rc}|AUDIT_LOG=${AUDIT_LOG}"
    exit "$rc"
}
trap finish EXIT

static_validate() {
    bash -n "$SCRIPT_PATH"
    grep -Fq -- '--cacheonly' "$SCRIPT_PATH"
    grep -Fq -- '--assumeno install "$SUPPORT_PACKAGE"' "$SCRIPT_PATH"
    if grep -En 'dnf[[:space:]]+(-y|--assumeyes)|systemctl[[:space:]]+(start|restart|enable|disable)|semanage[[:space:]]+(fcontext|port)[[:space:]]+-(a|m|d)|setfacl[[:space:]]+-|restorecon[[:space:]]' "$SCRIPT_PATH" |
        grep -v 'grep -En'; then
        return 1
    fi
    if grep -En 'cat[[:space:]]+[^|]*(redis5\.password|redis7\.password)|sha256sum[^|]*(redis5\.password|redis7\.password)' "$SCRIPT_PATH" |
        grep -v 'grep -En'; then
        return 1
    fi
    printf '%s\n' \
        'Q132_SEMANAGE_CACHE_DIAG_STATIC_VALIDATE=PASS' \
        'NETWORK_PACKAGE_DOWNLOAD=PROHIBITED' \
        'PACKAGE_INSTALL=PROHIBITED' \
        'ROLE_MUTATION=PROHIBITED'
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"
if [[ "${1:-}" == --static-validate ]]; then
    static_validate
    exit 0
fi
[[ $# -eq 0 ]]
[[ $(id -u) -eq 0 ]]
actual_host=$(hostname -s)
[[ "$actual_host" == "$EXPECTED_HOST" ]]
ip -o -4 addr show scope global | awk '{split($4,a,"/"); print a[1]}' | grep -Fxq "$EXPECTED_IP"
printf 'Q132_SEMANAGE_CACHE_DIAG_TARGET_IDENTITY=PASS|host=%s|ip=%s\n' "$actual_host" "$EXPECTED_IP"

[[ -f "$FAILED_SCRIPT" && ! -L "$FAILED_SCRIPT" ]]
printf '%s  %s\n' "$FAILED_SCRIPT_SHA256" "$FAILED_SCRIPT" | sha256sum -c -
[[ -f "$FAILED_AUDIT" && ! -L "$FAILED_AUDIT" ]]
grep -Fq "RUN_ID=q132-selinux-acl-activate-20260806T013430Z" "$FAILED_AUDIT"
grep -Fq "Cannot download repomd.xml" "$FAILED_AUDIT"
grep -Fq "All mirrors were tried" "$FAILED_AUDIT"
printf 'Q132_FAILED_RUN_AUDIT_GATE=PASS|failure=REPOSITORY_METADATA_TLS_NETWORK\n'

for command_name in rpm dnf stat find sort timeout systemctl ss getfacl sha256sum install tee; do
    command -v "$command_name" >/dev/null 2>&1 || {
        printf 'ERROR: required command is missing: %s\n' "$command_name" >&2
        exit 1
    }
done

install -d -o root -g root -m 0700 "$AUDIT_DIR"
exec > >(tee -a "$AUDIT_LOG") 2>&1
printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"

printf '%s\n' '=== INSTALLED SUPPORT STATE ==='
if rpm -q "$SUPPORT_PACKAGE"; then
    printf 'SUPPORT_PACKAGE_INSTALLED=YES\n'
else
    printf 'SUPPORT_PACKAGE_INSTALLED=NO\n'
fi
if command -v semanage >/dev/null 2>&1; then
    printf 'SEMANAGE_COMMAND=PRESENT|path=%s\n' "$(command -v semanage)"
else
    printf 'SEMANAGE_COMMAND=ABSENT\n'
fi

printf '%s\n' '=== ENABLED REPOSITORY CONFIG METADATA ==='
dnf --cacheonly --setopt=metadata_expire=-1 repolist --enabled 2>&1 || true
for repo_file in /etc/yum.repos.d/*.repo; do
    [[ -f "$repo_file" && ! -L "$repo_file" ]] || continue
    stat -c 'REPO_FILE|%U:%G|%a|%s|%n' "$repo_file"
    sha256sum "$repo_file"
    grep -E '^\[[^]]+\]$|^(enabled|gpgcheck|repo_gpgcheck|baseurl|metalink|mirrorlist)=' "$repo_file" || true
done

printf '%s\n' '=== CACHED METADATA ==='
find /var/cache/dnf -type f -path '*/repodata/repomd.xml' -printf 'CACHE_REPOMD|%TY-%Tm-%TdT%TH:%TM:%TS%Tz|%s|%p\n' 2>/dev/null | sort || true

printf '%s\n' '=== CACHED SUPPORT RPM FILES ==='
mapfile -d '' cached_rpms < <(find /var/cache/dnf -type f -name "${SUPPORT_PACKAGE}-*.rpm" -print0 2>/dev/null | sort -z)
printf 'CACHED_SUPPORT_RPM_COUNT=%s\n' "${#cached_rpms[@]}"
for rpm_file in "${cached_rpms[@]}"; do
    stat -c 'CACHED_RPM|%U:%G|%a|%s|%n' "$rpm_file"
    rpm -qp --qf 'CACHED_RPM_NEVRA|%{NAME}-%{EPOCHNUM}:%{VERSION}-%{RELEASE}.%{ARCH}\n' "$rpm_file" 2>&1 || true
    rpm -K "$rpm_file" 2>&1 || true
done

printf '%s\n' '=== CACHE-ONLY REPOQUERY ==='
set +e
dnf --cacheonly --setopt=metadata_expire=-1 -q repoquery --latest-limit 1 --qf 'CANDIDATE|%{name}-%{epoch}:%{version}-%{release}.%{arch}|repo=%{repoid}' "$SUPPORT_PACKAGE"
repoquery_rc=$?
set -e
printf 'CACHE_ONLY_REPOQUERY_RC=%s\n' "$repoquery_rc"

printf '%s\n' '=== CACHE-ONLY INSTALL PLAN ==='
plan_file="${AUDIT_DIR}/cacheonly-assumeno.log"
set +e
timeout 45s dnf --cacheonly --setopt=metadata_expire=-1 --assumeno install "$SUPPORT_PACKAGE" >"$plan_file" 2>&1
plan_rc=$?
set -e
cat "$plan_file"
printf 'CACHE_ONLY_ASSUMENO_RC=%s\n' "$plan_rc"
if [[ "$plan_rc" -eq 1 ]] && grep -Eq 'Installing:|Install[[:space:]]+[0-9]+ Package' "$plan_file" &&
   ! grep -Eq 'Removing:|Upgrading:|Downgrading:' "$plan_file"; then
    printf 'CACHE_ONLY_INSTALL_PLAN=PASS_RESOLVED_INSTALL_ONLY\n'
else
    printf 'CACHE_ONLY_INSTALL_PLAN=BLOCKED_NOT_RESOLVED_FROM_CACHE\n'
fi

printf '%s\n' '=== ROLE QUIET STATE ==='
for unit in redis5.service redis7.service sentinel5.service sentinel7.service orchestrator.service; do
    printf 'UNIT|%s|enabled=%s|active=%s\n' "$unit" \
        "$(systemctl is-enabled "$unit" 2>/dev/null || true)" \
        "$(systemctl is-active "$unit" 2>/dev/null || true)"
done
if ss -lntupH | grep -E ':(6379|6387|26379|26387|3000|10008)([[:space:]]|$)'; then
    printf 'TARGET_LISTENERS=PRESENT_UNEXPECTED\n'
else
    printf 'TARGET_LISTENERS=NONE\n'
fi
printf 'ETC_ACL_REDIS_ENTRY_COUNT=%s\n' "$(getfacl -cp /etc 2>/dev/null | grep -c '^user:redis:' || true)"
printf 'ETC_REDIS_METADATA=%s\n' "$(stat -c '%U:%G:%a' /etc/redis)"
for binary in /opt/redis/5.0.14/bin/redis-server /opt/redis/7.2.14/bin/redis-server; do
    stat -c 'BINARY_CONTEXT|%C|%n' "$binary"
done

if [[ "$repoquery_rc" -eq 0 && "$plan_rc" -eq 1 ]] &&
   grep -Fq 'CACHE_ONLY_INSTALL_PLAN=PASS_RESOLVED_INSTALL_ONLY' "$AUDIT_LOG"; then
    printf 'Q132_NEXT_PACKAGE_SOURCE_GATE=CACHE_METADATA_RESOLVES_PLAN_CHECK_RPM_PAYLOAD_AVAILABILITY\n'
else
    printf 'Q132_NEXT_PACKAGE_SOURCE_GATE=REQUIRES_SIGNED_OFFLINE_PACKAGE_CLOSURE_OR_APPROVED_NETWORK_WINDOW\n'
fi