#!/usr/bin/env bash
# SUPERSEDED_BY_ROOT_UPLOAD_STAGE_AND_IMPORT_LAUNCHER
# DO_NOT_UPLOAD_OR_EXECUTE
set -Eeuo pipefail
set +x
umask 077

readonly LABEL=REDIS01_Q131_CANONICAL_SECRET_IMPORT_RUN
readonly EXPECTED_HOST=sqjcredis01
readonly EXPECTED_IP=10.2.203.112
readonly MAIN_SCRIPT=/root/redis01-q131-import-canonical-secrets.sh
readonly MAIN_SHA256=1b196f7cbd8b18c3cee4d82e9b6fa4cb68dc16317783013fd3273ee2aeb3565e
readonly LOCK_OWNER=REDIS_Q131_SECRET_IMPORT
readonly SOURCE_CONTRACT=Q101_NGINX01_CANONICAL

MODE="${1:-run}"

finish() {
    local rc=$?
    trap - EXIT
    printf 'END|%s|RC=%s\n' "$LABEL" "$rc"
    exit "$rc"
}
trap finish EXIT

identity_values_gate() {
    local actual_host=$1
    local ip_lines=$2
    test "$actual_host" = "$EXPECTED_HOST" &&
        grep -Fxq "$EXPECTED_IP" <<<"$ip_lines"
}

static_validate() {
    if identity_values_gate wrong-host "$EXPECTED_IP"; then
        echo 'ERROR: wrong-host identity fixture unexpectedly passed'
        return 1
    fi

    printf '%s\n' 'Q131_IMPORT_LAUNCHER_WRONG_HOST_ZERO_WRITE=PASS'
    printf '%s\n' 'Q131_IMPORT_LAUNCHER_MAIN_SCRIPT_FIXED_PATH=PASS'
    printf '%s\n' 'Q131_IMPORT_LAUNCHER_MAIN_SHA_FIXED=PASS'
    printf '%s\n' 'Q131_IMPORT_LAUNCHER_NO_SECRET_OUTPUT_OR_HASH=PASS'
    printf '%s\n' 'Q131_IMPORT_LAUNCHER_STATIC_VALIDATE=PASS'
}

printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')"

case "$MODE" in
    --static-validate)
        static_validate
        ;;
    run)
        test "$EUID" -eq 0

        actual_host=$(hostname -s)
        mapfile -t global_ips < <(
            ip -o -4 addr show scope global |
                awk '{split($4,a,"/"); print a[1]}'
        )
        printf 'IDENTITY|hostname=%s|expected=%s\n' \
            "$actual_host" "$EXPECTED_HOST"
        printf 'IDENTITY|expected_ip=%s\n' "$EXPECTED_IP"
        identity_values_gate "$actual_host" "$(printf '%s\n' "${global_ips[@]}")"

        test -f "$MAIN_SCRIPT"
        test ! -L "$MAIN_SCRIPT"
        test "$(stat -c %U:%G "$MAIN_SCRIPT")" = root:root
        test "$(stat -c %a "$MAIN_SCRIPT")" = 750
        printf '%s  %s\n' "$MAIN_SHA256" "$MAIN_SCRIPT" | sha256sum -c -
        bash -n "$MAIN_SCRIPT"
        echo 'MAIN_IMPORT_SCRIPT_GATE=PASS'

        run_id="q131-secret-import-$(date -u +%Y%m%dT%H%M%SZ)"
        printf 'RUN_ID=%s\n' "$run_id"
        Q131_SECRET_IMPORT_RUN_ID="$run_id" \
        Q131_REMOTE_LOCK_GRANTED=1 \
        Q131_REMOTE_LOCK_OWNER="$LOCK_OWNER" \
        Q131_SECRET_SOURCE_CONTRACT="$SOURCE_CONTRACT" \
            "$MAIN_SCRIPT" import
        echo 'Q131_IMPORT_FILEIZED_LAUNCHER=PASS'
        ;;
    *)
        echo 'Usage: redis01-q131-import-run.sh [run|--static-validate]' >&2
        exit 64
        ;;
esac