#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

readonly EXPECTED_HOST="sqjcnginx01"
readonly EXPECTED_IP="10.2.203.102"
readonly EXPECTED_EXPORT_RUN_ID="q131-secret-export-20260730T015519Z"
readonly CLEANUP_RUN_ID="q131-secret-cleanup-20260805-controller-authorized"
readonly MAIN_SCRIPT="/root/q131-nginx01-export-redis-secrets.sh"
readonly MAIN_SCRIPT_SHA256="5ef6a5a2f1d01a8b732ed90d9b382e3e5ec2b8c4a1569b429115743f7a489eaa"
readonly STAGING_DIR="/root/q131-secret-transfer/redis-from-nginx01"
readonly RECEIPT="${STAGING_DIR}/SOURCE_RECEIPT.txt"
readonly SOURCE_DIR="/etc/zhct/secrets"
readonly LOCK_OWNER="NGINX_Q131_SECRET_EXPORT"
readonly SOURCE_CONTRACT="Q101_NGINX01_CANONICAL"
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"

mode="${1:-cleanup}"

finish() {
  local rc=$?
  printf 'Q131_CLEANUP_LAUNCHER_END MODE=%s RC=%s\n' "${mode}" "${rc}"
  exit "${rc}"
}
trap finish EXIT

die() {
  printf 'Q131_CLEANUP_ERROR=%s\n' "$*" >&2
  return 1
}

identity_gate() {
  local actual_host ip_lines
  actual_host="$(hostname -s)"
  ip_lines="$(ip -o -4 addr show)"
  printf 'Q131_CLEANUP_TARGET_HOST=%s\n' "${actual_host}"
  printf '%s\n' "${ip_lines}"
  [[ "${actual_host}" == "${EXPECTED_HOST}" ]] || die 'hostname mismatch'
  grep -Eq "(^|[[:space:]])${EXPECTED_IP}/" <<<"${ip_lines}" || die 'IP mismatch'
  printf 'Q131_CLEANUP_IDENTITY_GATE=PASS\n'
}

main_script_gate() {
  local owner_group file_mode actual_sha
  [[ -f "${MAIN_SCRIPT}" && ! -L "${MAIN_SCRIPT}" ]] || die 'main script missing or symlinked'
  owner_group="$(stat -c '%U:%G' -- "${MAIN_SCRIPT}")"
  file_mode="$(stat -c '%a' -- "${MAIN_SCRIPT}")"
  actual_sha="$(sha256sum -- "${MAIN_SCRIPT}" | awk '{print $1}')"
  [[ "${owner_group}" == "root:root" ]] || die 'main script owner mismatch'
  [[ "${file_mode}" == 600 || "${file_mode}" == 640 || "${file_mode}" == 700 || "${file_mode}" == 750 ]] ||
    die 'main script mode mismatch'
  [[ "${actual_sha}" == "${MAIN_SCRIPT_SHA256}" ]] || die 'main script SHA mismatch'
  printf 'Q131_CLEANUP_MAIN_SCRIPT_GATE=PASS SHA256=%s MODE=%s OWNER=%s\n' \
    "${actual_sha}" "${file_mode}" "${owner_group}"
}

source_metadata_fingerprint() {
  stat -c '%d:%i:%s:%Y:%a:%U:%G' -- "$1"
}

source_gate() {
  local name file
  [[ -d "${SOURCE_DIR}" && ! -L "${SOURCE_DIR}" ]] || die 'canonical source directory invalid'
  for name in redis5.password redis7.password; do
    file="${SOURCE_DIR}/${name}"
    [[ -f "${file}" && ! -L "${file}" && -s "${file}" ]] || die "canonical source invalid: ${name}"
    [[ "$(stat -c '%U:%G' -- "${file}")" == root:root ]] || die "canonical source owner mismatch: ${name}"
    case "$(stat -c '%a' -- "${file}")" in 600|400) ;; *) die "canonical source mode mismatch: ${name}" ;; esac
  done
  printf 'Q131_CLEANUP_CANONICAL_SOURCE_METADATA_GATE=PASS\n'
}

staging_receipt_gate() {
  local count name file
  [[ -d "${STAGING_DIR}" && ! -L "${STAGING_DIR}" ]] || die 'staging directory invalid'
  [[ "$(stat -c '%U:%G' -- "${STAGING_DIR}")" == root:root ]] || die 'staging owner mismatch'
  [[ "$(stat -c '%a' -- "${STAGING_DIR}")" == 700 ]] || die 'staging mode mismatch'
  count="$(find "${STAGING_DIR}" -mindepth 1 -maxdepth 1 -printf '%f\n' | wc -l)"
  [[ "${count}" -eq 3 ]] || die 'staging entry count mismatch'
  for name in redis5.password redis7.password; do
    file="${STAGING_DIR}/${name}"
    [[ -f "${file}" && ! -L "${file}" && -s "${file}" ]] || die "staged file invalid: ${name}"
    [[ "$(stat -c '%U:%G' -- "${file}")" == root:root ]] || die "staged owner mismatch: ${name}"
    [[ "$(stat -c '%a' -- "${file}")" == 600 ]] || die "staged mode mismatch: ${name}"
  done
  [[ -f "${RECEIPT}" && ! -L "${RECEIPT}" ]] || die 'receipt invalid'
  [[ "$(stat -c '%U:%G' -- "${RECEIPT}")" == root:root ]] || die 'receipt owner mismatch'
  [[ "$(stat -c '%a' -- "${RECEIPT}")" == 600 ]] || die 'receipt mode mismatch'
  [[ "$(wc -l <"${RECEIPT}")" -eq 10 ]] || die 'receipt line count mismatch'
  grep -Fxq 'Q131_SOURCE_RECEIPT_VERSION=1' "${RECEIPT}" || die 'receipt version mismatch'
  grep -Fxq "RUN_ID=${EXPECTED_EXPORT_RUN_ID}" "${RECEIPT}" || die 'receipt export run mismatch'
  grep -Fxq "SOURCE_HOST=${EXPECTED_HOST}" "${RECEIPT}" || die 'receipt host mismatch'
  grep -Fxq "SOURCE_IP=${EXPECTED_IP}" "${RECEIPT}" || die 'receipt IP mismatch'
  grep -Fxq "SOURCE_CONTRACT=${SOURCE_CONTRACT}" "${RECEIPT}" || die 'receipt contract mismatch'
  grep -Fxq 'SECRET_VALUES=NOT_OUTPUT_NOT_LOGGED' "${RECEIPT}" || die 'receipt value policy mismatch'
  grep -Fxq 'SECRET_CONTENT_SHA=NOT_CALCULATED' "${RECEIPT}" || die 'receipt hash policy mismatch'
  grep -Eq '^TRANSFER_FILE=redis5\.password .* STAGED=/root/q131-secret-transfer/redis-from-nginx01/redis5\.password OWNER=root:root MODE=600 SIZE=[1-9][0-9]*$' "${RECEIPT}" || die 'redis5 receipt mismatch'
  grep -Eq '^TRANSFER_FILE=redis7\.password .* STAGED=/root/q131-secret-transfer/redis-from-nginx01/redis7\.password OWNER=root:root MODE=600 SIZE=[1-9][0-9]*$' "${RECEIPT}" || die 'redis7 receipt mismatch'
  printf 'Q131_CLEANUP_RECEIPT_GATE=PASS EXPORT_RUN_ID=%s\n' "${EXPECTED_EXPORT_RUN_ID}"
  printf 'Q131_CLEANUP_EXACT_STAGING_ENTRIES=PASS COUNT=3\n'
}

static_validate() {
  bash -n "${SCRIPT_PATH}"
  [[ "${EXPECTED_HOST}" == sqjcnginx01 ]]
  [[ "${EXPECTED_IP}" == 10.2.203.102 ]]
  [[ "${EXPECTED_EXPORT_RUN_ID}" == q131-secret-export-20260730T015519Z ]]
  [[ "${STAGING_DIR}" == /root/q131-secret-transfer/redis-from-nginx01 ]]
  [[ "${MAIN_SCRIPT_SHA256}" == 5ef6a5a2f1d01a8b732ed90d9b382e3e5ec2b8c4a1569b429115743f7a489eaa ]]
  printf 'Q131_CLEANUP_LAUNCHER_STATIC_VALIDATE_PASS\n'
  printf 'Q131_CLEANUP_SCOPE=EXPORT_STAGING_ONLY\n'
  printf 'Q131_CANONICAL_SOURCE_DELETE=PROHIBITED\n'
}

printf 'Q131_CLEANUP_LAUNCHER_BEGIN MODE=%s\n' "${mode}"

case "${mode}" in
  --static-validate)
    static_validate
    ;;
  cleanup)
    [[ "${EUID}" -eq 0 ]] || die 'root required'
    identity_gate
    main_script_gate
    source_gate
    staging_receipt_gate
    before5="$(source_metadata_fingerprint "${SOURCE_DIR}/redis5.password")"
    before7="$(source_metadata_fingerprint "${SOURCE_DIR}/redis7.password")"
    printf 'Q131_CLEANUP_PRE_DELETE_GATE=PASS\n'
    env \
      Q131_SECRET_EXPORT_RUN_ID="${CLEANUP_RUN_ID}" \
      Q131_REMOTE_LOCK_GRANTED=1 \
      Q131_REMOTE_LOCK_OWNER="${LOCK_OWNER}" \
      Q131_SECRET_SOURCE_CONTRACT="${SOURCE_CONTRACT}" \
      Q131_SECRET_TRANSFER_CONSUMED=YES \
      bash "${MAIN_SCRIPT}" cleanup
    [[ ! -e "${STAGING_DIR}" ]] || die 'staging directory still exists after cleanup'
    after5="$(source_metadata_fingerprint "${SOURCE_DIR}/redis5.password")"
    after7="$(source_metadata_fingerprint "${SOURCE_DIR}/redis7.password")"
    [[ "${before5}" == "${after5}" && "${before7}" == "${after7}" ]] || die 'canonical source metadata changed'
    printf 'Q131_CLEANUP_STAGING_ABSENT_AFTER=PASS PATH=%s\n' "${STAGING_DIR}"
    printf 'Q131_CLEANUP_CANONICAL_SOURCE_UNCHANGED=PASS\n'
    printf 'Q131_NGINX01_EXPORT_STAGING_CLEANUP_PASS\n'
    ;;
  *)
    printf 'Usage: %s [--static-validate|cleanup]\n' "${SCRIPT_PATH}" >&2
    exit 64
    ;;
esac