#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

readonly EXPECTED_HOST="sqjcnginx01"
readonly EXPECTED_IP="10.2.203.102"
readonly MAIN_SCRIPT="/root/q131-nginx01-export-redis-secrets.sh"
readonly MAIN_SCRIPT_SHA256="5ef6a5a2f1d01a8b732ed90d9b382e3e5ec2b8c4a1569b429115743f7a489eaa"
readonly LOCK_OWNER="NGINX_Q131_SECRET_EXPORT"
readonly SOURCE_CONTRACT="Q101_NGINX01_CANONICAL"
readonly LAUNCHER_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"

MODE="${1:-export}"
RUN_ID="q131-secret-export-$(date -u +%Y%m%dT%H%M%SZ)"

finish() {
  local rc=$?
  printf 'Q131_EXPORT_LAUNCHER_END MODE=%s RC=%s\n' "${MODE}" "${rc}"
  exit "${rc}"
}
trap finish EXIT

identity_gate() {
  local actual_host ip_lines
  actual_host="$(hostname -s)"
  ip_lines="$(ip -o -4 addr show)"
  printf 'Q131_LAUNCHER_TARGET_HOST=%s\n' "${actual_host}"
  printf '%s\n' "${ip_lines}"
  [[ "${actual_host}" == "${EXPECTED_HOST}" ]]
  grep -Eq "(^|[[:space:]])${EXPECTED_IP}/" <<<"${ip_lines}"
  printf 'Q131_LAUNCHER_IDENTITY_GATE=PASS\n'
}

main_script_gate() {
  local owner_group mode actual_sha
  [[ -f "${MAIN_SCRIPT}" && ! -L "${MAIN_SCRIPT}" ]]
  owner_group="$(stat -c '%U:%G' -- "${MAIN_SCRIPT}")"
  mode="$(stat -c '%a' -- "${MAIN_SCRIPT}")"
  [[ "${owner_group}" == "root:root" ]]
  [[ "${mode}" == "600" || "${mode}" == "640" || "${mode}" == "700" || "${mode}" == "750" ]]
  actual_sha="$(sha256sum -- "${MAIN_SCRIPT}" | awk '{print $1}')"
  [[ "${actual_sha}" == "${MAIN_SCRIPT_SHA256}" ]]
  printf 'Q131_LAUNCHER_MAIN_SCRIPT=%s OWNER=%s MODE=%s\n' \
    "${MAIN_SCRIPT}" "${owner_group}" "${mode}"
  printf 'Q131_LAUNCHER_MAIN_SHA256=%s\n' "${actual_sha}"
  printf 'Q131_LAUNCHER_MAIN_SCRIPT_GATE=PASS\n'
}

static_validate() {
  bash -n "${LAUNCHER_PATH}"
  [[ "${EXPECTED_HOST}" == "sqjcnginx01" ]]
  [[ "${EXPECTED_IP}" == "10.2.203.102" ]]
  [[ "${MAIN_SCRIPT}" == "/root/q131-nginx01-export-redis-secrets.sh" ]]
  [[ "${MAIN_SCRIPT_SHA256}" == "5ef6a5a2f1d01a8b732ed90d9b382e3e5ec2b8c4a1569b429115743f7a489eaa" ]]
  printf 'Q131_EXPORT_LAUNCHER_STATIC_VALIDATE_PASS\n'
  printf 'Q131_EXPORT_LAUNCHER_CLEANUP=PROHIBITED\n'
}

printf 'Q131_EXPORT_LAUNCHER_BEGIN MODE=%s\n' "${MODE}"

case "${MODE}" in
  --static-validate)
    static_validate
    ;;
  export)
    [[ "${EUID}" -eq 0 ]]
    printf 'Q131_LAUNCHER_ROOT_GATE=PASS\n'
    identity_gate
    main_script_gate
    printf 'Q131_LAUNCHER_PRE_EXEC_GATE=PASS\n'
    env \
      Q131_SECRET_EXPORT_RUN_ID="${RUN_ID}" \
      Q131_REMOTE_LOCK_GRANTED=1 \
      Q131_REMOTE_LOCK_OWNER="${LOCK_OWNER}" \
      Q131_SECRET_SOURCE_CONTRACT="${SOURCE_CONTRACT}" \
      bash "${MAIN_SCRIPT}" export
    ;;
  *)
    printf 'Usage: %s [--static-validate]\n' "${LAUNCHER_PATH}" >&2
    exit 64
    ;;
esac