#!/usr/bin/env bash
set -Eeuo pipefail

EXPECTED_HOST=sqjcDB02
EXPECTED_IP=10.2.208.107
MYSQL80=/opt/mysql/8.0.46/bin/mysql
SOCKET=/run/mysql80/mysql.sock
ACTION=${1:-}
EVIDENCE_DIR=

finish() {
  local rc=$?
  [[ -z "${EVIDENCE_DIR:-}" ]] || {
    printf 'finished_at=%s\nexit_code=%s\nrollback_state=NO_SYSTEM_CHANGE_TO_ROLL_BACK\n' \
      "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$rc" >"$EVIDENCE_DIR/result.env"
    chmod 0600 "$EVIDENCE_DIR/result.env"
  }
  echo "END MYSQL02_MYSQL80_WWWWEB_READONLY_VERIFY RC=$rc"
}
trap finish EXIT

[[ "$ACTION" == run || "$ACTION" == --static-validate ]] || { echo "usage: $0 --static-validate|run" >&2; exit 2; }
if [[ "$ACTION" == --static-validate ]]; then
  bash -n "$0"
  echo MYSQL02_MYSQL80_WWWWEB_READONLY_STATIC_VALIDATE_PASS
  exit 0
fi

echo BEGIN MYSQL02_MYSQL80_WWWWEB_READONLY_VERIFY
[[ "$(hostname -s)" == "$EXPECTED_HOST" ]] || { echo 'ERROR: wrong hostname'; exit 1; }
[[ "$EUID" -eq 0 ]] || { echo 'ERROR: root required'; exit 1; }
ip -o -4 addr show scope global | grep -q "${EXPECTED_IP//./\\.}/" || { echo 'ERROR: wrong IP'; exit 1; }

run_id="mysql80-wwwweb-verify-$(date '+%Y%m%dT%H%M%S%z')"
EVIDENCE_DIR="/var/backups/zhct-mysql80-wwwweb/$run_id"
install -d -m 0700 -o root -g root "$EVIDENCE_DIR"
exec > >(tee "$EVIDENCE_DIR/operator.log") 2>&1
chmod 0600 "$EVIDENCE_DIR/operator.log"

echo "started_at=$(date '+%Y-%m-%dT%H:%M:%S%z')"
[[ -x "$MYSQL80" && -S "$SOCKET" ]] || { echo 'ERROR: MySQL8 client or socket unavailable'; exit 1; }

identity=$($MYSQL80 --no-defaults --protocol=socket --socket="$SOCKET" --batch --skip-column-names \
  -e 'SELECT @@port,@@server_id,@@server_uuid,@@global.gtid_mode,@@global.read_only,@@global.super_read_only')
read -r port sid uuid gtid ro sro <<<"$identity"
[[ "$port:$sid:$gtid:$ro:$sro" == '3308:80107:ON:1:1' ]] || { echo 'ERROR: replica identity/read-only contract mismatch'; exit 1; }

status=$($MYSQL80 --no-defaults --protocol=socket --socket="$SOCKET" --vertical -e 'SHOW REPLICA STATUS')
for expected in \
  'Source_Host: 10.2.208.106' \
  'Source_Port: 3308' \
  'Replica_IO_Running: Yes' \
  'Replica_SQL_Running: Yes' \
  'Auto_Position: 1' \
  'Last_IO_Errno: 0' \
  'Last_SQL_Errno: 0'; do
  grep -Fq "$expected" <<<"$status" || { echo "ERROR: replication contract mismatch: $expected"; exit 1; }
done
lag=$(awk -F: '/Seconds_Behind_Source:/ {gsub(/[[:space:]]/,"",$2); print $2}' <<<"$status")
[[ "$lag" =~ ^[0-9]+$ ]] || { echo 'ERROR: replication lag unavailable'; exit 1; }
unset status

meta=$($MYSQL80 --no-defaults --protocol=socket --socket="$SOCKET" --batch --skip-column-names \
  -e "SELECT CONCAT(User,'@',Host,'|',plugin,'|',account_locked) FROM mysql.user WHERE User='wwwweb' AND Host='%'")
[[ "$meta" == 'wwwweb@%|mysql_native_password|N' ]] || { echo 'ERROR: replicated account metadata mismatch'; exit 1; }
grants=$($MYSQL80 --no-defaults --protocol=socket --socket="$SOCKET" --batch --skip-column-names \
  -e "SHOW GRANTS FOR 'wwwweb'@'%'")
grep -Fqx "GRANT ALL PRIVILEGES ON *.* TO \`wwwweb\`@\`%\` WITH GRANT OPTION" <<<"$grants" || {
  echo 'ERROR: replicated grant contract mismatch'; exit 1;
}
unset grants

echo "MYSQL80_REPLICA_IDENTITY=PASS port=$port server_id=$sid server_uuid=$uuid"
echo "MYSQL80_REPLICATION=PASS source=10.2.208.106:3308 lag_seconds=$lag"
echo "MYSQL80_WWWWEB_METADATA=PASS account=$meta"
echo 'MYSQL80_WWWWEB_GRANT_CONTRACT=PASS'
echo 'READ_ONLY_VERIFY=PASS_NO_SYSTEM_CHANGE'
echo 'BUSINESS_SQL=NOT_PERFORMED'
echo MYSQL02_MYSQL80_WWWWEB_READONLY_VERIFY_PASS