#!/usr/bin/env bash

set -Eeuo pipefail
umask 077

SCRIPT_PATH=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/$(basename "${BASH_SOURCE[0]}")
mode=${1:-}

die() {
    printf 'Q160_MYSQL01_DIAGNOSTIC_ERROR=%s\n' "$*" >&2
    return 1
}

finish() {
    local rc=$?
    printf 'Q160_MYSQL01_MY80_DIAGNOSTIC_END=%s\n' "$mode"
    printf 'finished_at=%s\n' "$(date '+%Y-%m-%dT%H:%M:%S%z')"
    printf 'Q160_MYSQL01_MY80_DIAGNOSTIC_RC=%s\n' "$rc"
    printf 'Q160_MYSQL01_MY80_DIAGNOSTIC_ROLLBACK=NO_SYSTEM_CHANGE_TO_ROLL_BACK\n'
    printf 'Q160_MYSQL_V1_RERUN=PROHIBITED\n'
    printf 'Q160_MYSQL02_EXECUTION=BLOCKED_PENDING_DIAGNOSTIC\n'
    printf 'Q192_Q200_Q221_Q261=NOT_PERFORMED\n'
    return "$rc"
}
trap finish EXIT

case "$mode" in
    --static-validate|run) [[ $# -eq 1 ]] || exit 2 ;;
    *) printf 'Usage: %s --static-validate|run\n' "$0" >&2; exit 2 ;;
esac

printf 'Q160_MYSQL01_MY80_DIAGNOSTIC_BEGIN=%s\n' "$mode"
printf 'started_at=%s\n' "$(date '+%Y-%m-%dT%H:%M:%S%z')"

if [[ "$mode" == --static-validate ]]; then
    bash -n "$SCRIPT_PATH"
    for marker in MYSQLX_APPROVED_DELTA NORMALIZED_MY80_TEMPLATE_SHA256 Q160_MYSQL01_MY80_DELTA_DIAGNOSTIC_OK; do
        grep -Fq "$marker" "$SCRIPT_PATH" || die "missing marker: $marker"
    done
    printf 'Q160_MYSQL01_MY80_DIAGNOSTIC_STATIC_VALIDATE_PASS\n'
    exit 0
fi

[[ $(id -u) -eq 0 ]] || die 'root is required for read-only metadata inspection'
[[ $(hostname -s) == sqjcDB01 ]] || die 'wrong hostname'
ip -o -4 addr show scope global | awk '{print $4}' | cut -d/ -f1 |
    grep -Fxq 10.2.208.106 || die 'wrong target IP'
printf 'Q160_MYSQL01_DIAGNOSTIC_IDENTITY=PASS\n'

base=/opt/zhct-deploy/roles/mysql/templates/nodes/mysql01/my80.cnf
staged=/etc/zhct/templates/mysql/nodes/mysql01/my80.cnf
live=/etc/my80.cnf
receipt=/root/sanquan-mysql-q121-evidence-q121-20260729T185007+0800.tar.gz
expected_base_sha=318384660f42fddb891e9218fdf4674996d5d8ee4232bcc3f6c7b76b364580cf
expected_receipt_sha=e1b48bace6b73697278d0313a6c27e8be7c2e3fce231cfa8f2e8f6548261a116

for file in "$base" "$staged" "$live" "$receipt"; do
    [[ -f "$file" && ! -L "$file" ]] || die "missing or unsafe file: $file"
    stat -c 'FILE mode=%a owner=%U:%G size=%s path=%n' "$file"
    sha256sum "$file"
done

[[ $(sha256sum "$base" | awk '{print $1}') == "$expected_base_sha" ]] ||
    die 'immutable package template digest mismatch'
[[ $(sha256sum "$receipt" | awk '{print $1}') == "$expected_receipt_sha" ]] ||
    die 'Q-121 receipt digest mismatch'
cmp -s "$staged" "$live" || die 'staged and live my80.cnf differ'

base_mysqlx_count=$(grep -Ec '^[[:space:]]*mysqlx[[:space:]]*=' "$base" || true)
staged_mysqlx_count=$(grep -Ec '^[[:space:]]*mysqlx[[:space:]]*=[[:space:]]*OFF[[:space:]]*$' "$staged" || true)
live_mysqlx_count=$(grep -Ec '^[[:space:]]*mysqlx[[:space:]]*=[[:space:]]*OFF[[:space:]]*$' "$live" || true)
printf 'BASE_MYSQLX_SETTING_COUNT=%s\n' "$base_mysqlx_count"
printf 'STAGED_MYSQLX_OFF_COUNT=%s\n' "$staged_mysqlx_count"
printf 'LIVE_MYSQLX_OFF_COUNT=%s\n' "$live_mysqlx_count"
[[ "$base_mysqlx_count" -eq 0 && "$staged_mysqlx_count" -eq 1 && "$live_mysqlx_count" -eq 1 ]] ||
    die 'mysqlx approved delta count mismatch'

normalized_sha() {
    awk '!/^[[:space:]]*mysqlx[[:space:]]*=[[:space:]]*OFF[[:space:]]*$/' "$1" |
        sha256sum | awk '{print $1}'
}

base_normalized=$(normalized_sha "$base")
staged_normalized=$(normalized_sha "$staged")
live_normalized=$(normalized_sha "$live")
printf 'NORMALIZED_MY80_TEMPLATE_SHA256 base=%s staged=%s live=%s\n' \
    "$base_normalized" "$staged_normalized" "$live_normalized"
[[ "$base_normalized" == "$staged_normalized" && "$base_normalized" == "$live_normalized" ]] ||
    die 'my80.cnf has drift beyond mysqlx=OFF'

printf 'SAFE_MY80_IDENTITY_BEGIN\n'
grep -E '^[[:space:]]*(bind-address|port|server-id|read-only|super-read-only|mysqlx)[[:space:]]*=' "$live"
printf 'SAFE_MY80_IDENTITY_END\n'

for unit in mysql56.service mysql80.service mysql-health56.service mysql-health80.service; do
    printf 'UNIT=%s ENABLED=%s ACTIVE=%s\n' "$unit" \
        "$(systemctl is-enabled "$unit" 2>/dev/null || true)" \
        "$(systemctl is-active "$unit" 2>/dev/null || true)"
done
if ss -lntH | awk '$4 == "10.2.208.106:33060" {found=1} END {exit !found}'; then
    die 'forbidden MySQL X listener 33060 is present'
fi

printf 'MYSQLX_APPROVED_DELTA=PASS_ONLY_MYSQLX_OFF\n'
printf 'Q121_PASS=UNCHANGED\n'
printf 'Q160_MYSQL01_MY80_DELTA_DIAGNOSTIC_OK\n'