#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

readonly EXPECTED_HOSTNAME='sqjcmqtt01'
readonly EXPECTED_IP='10.2.203.108'
readonly AUDIT_LOG='/root/q141-post-restore-quiet-gate.log'

exec > >(tee "${AUDIT_LOG}") 2>&1

q141_finish() {
  q141_rc=$?
  trap - EXIT
  printf '%s\n' 'Q141_POST_RESTORE_QUIET_GATE_END'
  printf 'Q141_POST_RESTORE_QUIET_GATE_RC=%s\n' "${q141_rc}"
  exit "${q141_rc}"
}
trap q141_finish EXIT

printf '%s\n' 'Q141_POST_RESTORE_QUIET_GATE_BEGIN'

printf '%s\n' '=== TARGET IDENTITY ==='
hostname -s | grep -Fx "${EXPECTED_HOSTNAME}"
ip -br -4 addr show ens192
ip -br -4 addr show ens192 | grep -F "${EXPECTED_IP}/24"

printf '%s\n' '=== RESTORED HASHES ==='
printf '%s  %s\n' \
  'ca5fa0a113739bcbe3ff51b2815bb50723cd8b1cf33dfb6d3f3f172caf2dabc6' \
  '/opt/zhct-deploy/common/scripts/post-clone.sh' | sha256sum -c -
printf '%s  %s\n' \
  'e637ca657a897c6d0b689bbd6347f04516baf5c9f32350cd1e8a2071c211a0a5' \
  '/opt/zhct-deploy/common/scripts/activate-role.sh' | sha256sum -c -
printf '%s  %s\n' \
  '9ffed09e41e384092d469b3c1e39fe5b05aee160c32eda69c80e5af87ce01441' \
  '/etc/zhct/templates/emqx/nodes/emqx01/emqx.conf' | sha256sum -c -
printf '%s  %s\n' \
  'eda667a180add2a54decd6b5bc9f47529ca8f742eaa98c6bf278ebbf6aa3c712' \
  '/usr/local/sbin/provision-emqx-cookie.sh' | sha256sum -c -
stat -c 'PROVISIONER_OWNER=%U:%G PROVISIONER_MODE=%a' /usr/local/sbin/provision-emqx-cookie.sh
test "$(stat -c '%U:%G' /usr/local/sbin/provision-emqx-cookie.sh)" = 'root:root'
test "$(stat -c '%a' /usr/local/sbin/provision-emqx-cookie.sh)" = '750'

printf '%s\n' '=== NODE ENV ==='
stat -c 'NODE_ENV_OWNER=%U:%G NODE_ENV_MODE=%a NODE_ENV_SIZE=%s' \
  /etc/zhct/node.env
test "$(stat -c '%U:%G' /etc/zhct/node.env)" = 'root:root'
test "$(stat -c '%a' /etc/zhct/node.env)" = '640'
grep -Fx 'ROLE=emqx' /etc/zhct/node.env
grep -Fx 'NODE_KEY=emqx01' /etc/zhct/node.env
grep -Fx 'NODE_IP=10.2.203.108' /etc/zhct/node.env
grep -Fx 'NODE_NAME=sqjcmqtt01' /etc/zhct/node.env

printf '%s\n' '=== SECRET ABSENCE ONLY ==='
test ! -e /etc/zhct/secrets/emqx.cluster-cookie
printf '%s\n' 'COOKIE_ABSENT'

printf '%s\n' '=== RUNTIME CONFIG METADATA ==='
if test -e /etc/emqx/emqx.conf; then
  sha256sum /etc/emqx/emqx.conf
else
  printf '%s\n' 'RUNTIME_CONFIG_ABSENT'
fi

printf '%s\n' '=== UNITS ==='
for q141_unit in emqx.service mosquitto.service; do
  q141_enabled=$(systemctl is-enabled "${q141_unit}" 2>&1 || true)
  q141_active=$(systemctl is-active "${q141_unit}" 2>&1 || true)
  printf '%s enabled=%s active=%s\n' \
    "${q141_unit}" "${q141_enabled}" "${q141_active}"
  test "${q141_enabled}" = 'disabled'
  test "${q141_active}" = 'inactive'
done

printf '%s\n' '=== PROCESSES AND LISTENERS ==='
if pgrep -x beam.smp >/dev/null || pgrep -x mosquitto >/dev/null; then
  printf '%s\n' 'TARGET_PROCESS_UNEXPECTED'
  exit 1
fi
printf '%s\n' 'TARGET_PROCESSES_ZERO'

if ss -lntupH |
  grep -E ':(1883|8083|18083|4370|5370|8883|8084)([[:space:]]|$)'; then
  printf '%s\n' 'TARGET_LISTENER_UNEXPECTED'
  exit 1
fi
printf '%s\n' 'TARGET_LISTENERS_ZERO'

test ! -e /root/q141-pre-restore-emqx-templates.tar.gz
test ! -e /root/q141-pre-restore-provision-emqx-cookie.sh
printf '%s\n' 'PREEXISTING_BACKUPS_NOT_NEEDED'
printf '%s\n' 'POST_CLONE_NOT_RUN'
printf '%s\n' 'COOKIE_NOT_GENERATED'
printf '%s\n' 'ACTIVATE_ROLE_NOT_RUN'
printf '%s\n' 'Q200_NOT_PERFORMED'
printf '%s\n' 'Q240_NOT_PERFORMED'
printf '%s\n' 'Q141_POST_RESTORE_QUIET_GATE_PASS'