#!/usr/bin/env bash
set -Eeuo pipefail
set +x
umask 077

readonly EXPECTED_HOST="sqjcredis01"
readonly EXPECTED_IP="10.2.203.112"
readonly EXPECTED_LOCK_OWNER="REDIS_Q131_SFTP_HANDOFF_VERIFY"
readonly SOURCE_CONTRACT="Q101_NGINX01_CANONICAL"
readonly SOURCE_STAGING="/root/q131-secret-transfer/redis-from-nginx01"
readonly TARGET_STAGING="/root/q131-secret-import/from-nginx01"
readonly SECRET5="${TARGET_STAGING}/redis5.password"
readonly SECRET7="${TARGET_STAGING}/redis7.password"
readonly RECEIPT="${TARGET_STAGING}/SOURCE_RECEIPT.txt"
readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")"

MODE="${1:---static-validate}"

finish() {
  local rc=$?
  printf 'Q131_SFTP_HANDOFF_VERIFY_END MODE=%s RC=%s\n' "${MODE}" "${rc}"
  exit "${rc}"
}
trap finish EXIT

identity_values_gate() {
  local actual_host="$1"
  local ip_lines="$2"
  [[ "${actual_host}" == "${EXPECTED_HOST}" ]] &&
    grep -Eq "(^|[[:space:]])${EXPECTED_IP}/" <<<"${ip_lines}"
}

identity_gate() {
  local actual_host ip_lines
  [[ "${EUID}" -eq 0 ]]
  actual_host="$(hostname -s)"
  ip_lines="$(ip -o -4 addr show scope global)"
  identity_values_gate "${actual_host}" "${ip_lines}"
  printf 'Q131_SFTP_HANDOFF_TARGET=%s/%s\n' "${EXPECTED_HOST}" "${EXPECTED_IP}"
  printf 'Q131_SFTP_HANDOFF_IDENTITY_GATE=PASS\n'
}

lock_gate() {
  [[ "${Q131_SFTP_HANDOFF_LOCK_GRANTED:-}" == "1" ]]
  [[ "${Q131_SFTP_HANDOFF_LOCK_OWNER:-}" == "${EXPECTED_LOCK_OWNER}" ]]
  printf 'Q131_SFTP_HANDOFF_LOCK_GATE=PASS\n'
}

safe_metadata() {
  stat -c 'PATH=%n OWNER=%U:%G MODE=%a SIZE=%s' -- "$1"
}

validate_secret_metadata() {
  local file="$1"
  [[ -f "${file}" && ! -L "${file}" ]]
  [[ "$(stat -c '%U:%G' -- "${file}")" == "root:root" ]]
  [[ "$(stat -c '%a' -- "${file}")" == "600" ]]
  [[ "$(stat -c '%s' -- "${file}")" -gt 0 ]]
}

validate_receipt_contract() {
  local size5 size7 expected5 expected7
  [[ -f "${RECEIPT}" && ! -L "${RECEIPT}" ]]
  [[ "$(stat -c '%U:%G' -- "${RECEIPT}")" == "root:root" ]]
  [[ "$(stat -c '%a' -- "${RECEIPT}")" == "600" ]]
  [[ "$(awk 'END {print NR+0}' "${RECEIPT}")" -eq 10 ]]
  grep -Fxq 'Q131_SOURCE_RECEIPT_VERSION=1' "${RECEIPT}"
  grep -Eq '^RUN_ID=q131-secret-export-[A-Za-z0-9._-]+$' "${RECEIPT}"
  grep -Eq '^CREATED_AT=[^[:space:]]+$' "${RECEIPT}"
  grep -Fxq 'SOURCE_HOST=sqjcnginx01' "${RECEIPT}"
  grep -Fxq 'SOURCE_IP=10.2.203.102' "${RECEIPT}"
  grep -Fxq "SOURCE_CONTRACT=${SOURCE_CONTRACT}" "${RECEIPT}"
  grep -Fxq 'SECRET_VALUES=NOT_OUTPUT_NOT_LOGGED' "${RECEIPT}"
  grep -Fxq 'SECRET_CONTENT_SHA=NOT_CALCULATED' "${RECEIPT}"
  [[ "$(grep -c '^TRANSFER_FILE=' "${RECEIPT}")" -eq 2 ]]
  size5="$(stat -c '%s' -- "${SECRET5}")"
  size7="$(stat -c '%s' -- "${SECRET7}")"
  expected5="TRANSFER_FILE=redis5.password SOURCE=/etc/zhct/secrets/redis5.password STAGED=${SOURCE_STAGING}/redis5.password OWNER=root:root MODE=600 SIZE=${size5}"
  expected7="TRANSFER_FILE=redis7.password SOURCE=/etc/zhct/secrets/redis7.password STAGED=${SOURCE_STAGING}/redis7.password OWNER=root:root MODE=600 SIZE=${size7}"
  grep -Fxq "${expected5}" "${RECEIPT}"
  grep -Fxq "${expected7}" "${RECEIPT}"
}

static_validate() {
  bash -n "${SCRIPT_PATH}"
  [[ "${EXPECTED_HOST}" == "sqjcredis01" ]]
  [[ "${EXPECTED_IP}" == "10.2.203.112" ]]
  [[ "${TARGET_STAGING}" == "/root/q131-secret-import/from-nginx01" ]]
  if identity_values_gate "wrong-host" "${EXPECTED_IP}/24"; then
    printf 'Q131_SFTP_HANDOFF_WRONG_HOST_TEST=FAIL\n'
    return 1
  fi
  printf 'Q131_SFTP_HANDOFF_WRONG_HOST_ZERO_WRITE=PASS\n'
  printf 'Q131_SFTP_HANDOFF_SECRET_CONTENT_READ=PROHIBITED\n'
  printf 'Q131_SFTP_HANDOFF_SECRET_CONTENT_HASH=PROHIBITED\n'
  printf 'Q131_SFTP_HANDOFF_CLEANUP=PROHIBITED\n'
  printf 'Q131_SFTP_HANDOFF_STATIC_VALIDATE_PASS\n'
}

verify_handoff() {
  printf 'Q131_SFTP_HANDOFF_VERIFY_BEGIN MODE=verify\n'
  identity_gate
  lock_gate
  [[ -d "${TARGET_STAGING}" && ! -L "${TARGET_STAGING}" ]]
  [[ "$(stat -c '%U:%G' -- "${TARGET_STAGING}")" == "root:root" ]]
  [[ "$(stat -c '%a' -- "${TARGET_STAGING}")" == "700" ]]
  validate_secret_metadata "${SECRET5}"
  validate_secret_metadata "${SECRET7}"
  validate_receipt_contract
  printf 'HANDOFF_FILE %s\n' "$(safe_metadata "${SECRET5}")"
  printf 'HANDOFF_FILE %s\n' "$(safe_metadata "${SECRET7}")"
  printf 'HANDOFF_FILE %s\n' "$(safe_metadata "${RECEIPT}")"
  printf 'Q131_SFTP_HANDOFF_RECEIPT_CONTRACT_V1=PASS\n'
  printf 'Q131_SFTP_HANDOFF_SECRET_CONTENT_READ=NO\n'
  printf 'Q131_SFTP_HANDOFF_SECRET_CONTENT_HASH=NO\n'
  printf 'Q131_SFTP_HANDOFF_CLEANUP=PROHIBITED\n'
  printf 'Q131_SFTP_HANDOFF_VERIFY_PASS\n'
}

case "${MODE}" in
  --static-validate)
    static_validate
    ;;
  verify)
    verify_handoff
    ;;
  *)
    printf 'Usage: %s --static-validate|verify\n' "${SCRIPT_PATH}" >&2
    exit 64
    ;;
esac