#!/usr/bin/env bash
set -Eeuo pipefail

STEP_ID="${STEP_ID:?}"
STEP_DIR="${STEP_DIR:?}"

REPORT="$STEP_DIR/report.txt"
FACTS="$STEP_DIR/facts.json"
VERIFY="$STEP_DIR/verify.txt"
LOG="$STEP_DIR/main.log"
ROLLBACK="$STEP_DIR/rollback.txt"

LIVE_FILE="/opt/router-ops/bin/router-publish-report"
LIVE_COPY="$STEP_DIR/router-publish-report.live"
PUBLISHED_COPY="$STEP_DIR/router-publish-report.published"
EXACT_DIFF="$STEP_DIR/router-publish-report.exact.diff"
STORED_DIFF_COPY="$STEP_DIR/router-publish-report.r04c.diff"

exec > >(tee -a "$LOG") 2>&1

progress() {
    printf '>>> [%s] %s\n' "$(date '+%F %T')" "$*"
}

stop_readonly() {
    echo "RESULT=$1"
    echo "SYSTEM_CHANGE=false"
    echo "RUNTIME_IMPACT=false"
    exit 20
}

progress "locating latest successful R04C audit"

R04C_DIR="$(
    find /opt/router-ops/steps \
        -mindepth 1 \
        -maxdepth 1 \
        -type d \
        -name '*_PRECHECK_VM130_PUBLISHED_SOURCE_DIFF_R04C' \
        -printf '%T@ %p\n' 2>/dev/null |
    sort -nr |
    awk 'NR==1 {$1=""; sub(/^ /,""); print}'
)"

[[ -n "$R04C_DIR" && -d "$R04C_DIR" ]] ||
    stop_readonly "STOP_R04C_DIRECTORY_NOT_FOUND"

R04C_REPORT="$R04C_DIR/report.txt"
R04C_COMPARE="$R04C_DIR/live-vs-published.tsv"
R04C_DIFF="$R04C_DIR/diffs/router-publish-report.diff"

[[ -s "$R04C_REPORT" ]] ||
    stop_readonly "STOP_R04C_REPORT_NOT_FOUND"

grep -qx 'RESULT=PASS_VM130_PUBLISHED_SOURCE_DIFF_AUDIT' "$R04C_REPORT" ||
    stop_readonly "STOP_R04C_NOT_CONFIRMED_PASS"

[[ -s "$R04C_COMPARE" ]] ||
    stop_readonly "STOP_R04C_COMPARE_NOT_FOUND"

[[ -s "$R04C_DIFF" ]] ||
    stop_readonly "STOP_R04C_DIFF_NOT_FOUND"

[[ -f "$LIVE_FILE" && -r "$LIVE_FILE" ]] ||
    stop_readonly "STOP_LIVE_PUBLISHER_NOT_FOUND"

progress "resolving published source file"

PUBLISHED_FILE="$(
    awk -F '\t' \
        '$1=="/opt/router-ops/bin/router-publish-report" {
            print $2
        }' \
        "$R04C_COMPARE" |
    tail -n 1
)"

[[ -n "$PUBLISHED_FILE" && -f "$PUBLISHED_FILE" ]] ||
    stop_readonly "STOP_PUBLISHED_PUBLISHER_NOT_FOUND"

progress "saving exact live and published copies"

cp -a "$LIVE_FILE" "$LIVE_COPY"
cp -a "$PUBLISHED_FILE" "$PUBLISHED_COPY"
cp -a "$R04C_DIFF" "$STORED_DIFF_COPY"

LIVE_SHA256="$(sha256sum "$LIVE_FILE" | awk '{print $1}')"
LIVE_COPY_SHA256="$(sha256sum "$LIVE_COPY" | awk '{print $1}')"
PUBLISHED_SHA256="$(sha256sum "$PUBLISHED_FILE" | awk '{print $1}')"
PUBLISHED_COPY_SHA256="$(sha256sum "$PUBLISHED_COPY" | awk '{print $1}')"

[[ "$LIVE_SHA256" == "$LIVE_COPY_SHA256" ]] ||
    stop_readonly "STOP_LIVE_COPY_SHA256_MISMATCH"

[[ "$PUBLISHED_SHA256" == "$PUBLISHED_COPY_SHA256" ]] ||
    stop_readonly "STOP_PUBLISHED_COPY_SHA256_MISMATCH"

progress "regenerating exact diff"

set +e
diff -u \
    --label "published/router-publish-report" \
    --label "live/router-publish-report" \
    "$PUBLISHED_COPY" \
    "$LIVE_COPY" \
    > "$EXACT_DIFF"
DIFF_RC=$?
set -e

[[ "$DIFF_RC" -eq 1 ]] ||
    stop_readonly "STOP_UNEXPECTED_DIFF_RESULT"

EXACT_DIFF_SHA256="$(sha256sum "$EXACT_DIFF" | awk '{print $1}')"
STORED_DIFF_SHA256="$(sha256sum "$STORED_DIFF_COPY" | awk '{print $1}')"

STORED_DIFF_MATCH=false

if cmp -s "$EXACT_DIFF" "$STORED_DIFF_COPY"; then
    STORED_DIFF_MATCH=true
fi

LIVE_SYNTAX=FAIL
PUBLISHED_SYNTAX=FAIL

if bash -n "$LIVE_COPY"; then
    LIVE_SYNTAX=PASS
fi

if bash -n "$PUBLISHED_COPY"; then
    PUBLISHED_SYNTAX=PASS
fi

DIFF_LINE_COUNT="$(wc -l < "$EXACT_DIFF" | tr -d ' ')"
DIFF_HUNK_COUNT="$(
    grep -c '^@@ ' "$EXACT_DIFF" 2>/dev/null ||
    true
)"

LIVE_TRYCF_COUNT="$(
    grep -Ec 'trycloudflare\.com|TRYCF_BASE' "$LIVE_COPY" 2>/dev/null ||
    true
)"

LIVE_PERMANENT_COUNT="$(
    grep -c 'reports\.secret-studio\.ru' "$LIVE_COPY" 2>/dev/null ||
    true
)"

AUDIT_COMPLETE=false

if [[ "$LIVE_SYNTAX" == "PASS" ]] &&
   [[ "$PUBLISHED_SYNTAX" == "PASS" ]] &&
   [[ "$DIFF_RC" -eq 1 ]] &&
   [[ "$DIFF_LINE_COUNT" -gt 0 ]] &&
   [[ "$STORED_DIFF_MATCH" == true ]]; then
    AUDIT_COMPLETE=true
fi

if [[ "$AUDIT_COMPLETE" == true ]]; then
    RESULT="PASS_ROUTER_PUBLISH_REPORT_EXACT_DIFF"
    RUN_RC=0
else
    RESULT="STOP_ROUTER_PUBLISH_REPORT_DIFF_INCOMPLETE"
    RUN_RC=20
fi

cat > "$ROLLBACK" <<EOF
ROLLBACK_REQUIRED=false
REASON=Read-only comparison. No operational source, service, Caddy configuration, Git state or public object was changed.
EOF

cat > "$FACTS" <<EOF
{
  "step_id": "$STEP_ID",
  "result": "$RESULT",
  "read_only": true,
  "system_change": false,
  "runtime_impact": false,
  "r04c_directory": "$R04C_DIR",
  "live_file": "$LIVE_FILE",
  "published_file": "$PUBLISHED_FILE",
  "live_sha256": "$LIVE_SHA256",
  "published_sha256": "$PUBLISHED_SHA256",
  "exact_diff_sha256": "$EXACT_DIFF_SHA256",
  "stored_diff_sha256": "$STORED_DIFF_SHA256",
  "stored_diff_match": $STORED_DIFF_MATCH,
  "diff_line_count": $DIFF_LINE_COUNT,
  "diff_hunk_count": $DIFF_HUNK_COUNT,
  "live_trycloudflare_reference_count": $LIVE_TRYCF_COUNT,
  "live_permanent_domain_reference_count": $LIVE_PERMANENT_COUNT,
  "live_syntax": "$LIVE_SYNTAX",
  "published_syntax": "$PUBLISHED_SYNTAX",
  "audit_complete": $AUDIT_COMPLETE
}
EOF

python3 -m json.tool "$FACTS" >/dev/null

cat > "$VERIFY" <<EOF
STEP_ID=$STEP_ID
RESULT=$RESULT
SYSTEM_CHANGE=false
RUNTIME_IMPACT=false
R04C_DIR=$R04C_DIR
LIVE_FILE=$LIVE_FILE
PUBLISHED_FILE=$PUBLISHED_FILE
LIVE_SHA256=$LIVE_SHA256
LIVE_COPY_SHA256=$LIVE_COPY_SHA256
PUBLISHED_SHA256=$PUBLISHED_SHA256
PUBLISHED_COPY_SHA256=$PUBLISHED_COPY_SHA256
EXACT_DIFF_SHA256=$EXACT_DIFF_SHA256
STORED_DIFF_SHA256=$STORED_DIFF_SHA256
STORED_DIFF_MATCH=$STORED_DIFF_MATCH
DIFF_RC=$DIFF_RC
DIFF_LINE_COUNT=$DIFF_LINE_COUNT
DIFF_HUNK_COUNT=$DIFF_HUNK_COUNT
LIVE_TRYCF_COUNT=$LIVE_TRYCF_COUNT
LIVE_PERMANENT_COUNT=$LIVE_PERMANENT_COUNT
LIVE_SYNTAX=$LIVE_SYNTAX
PUBLISHED_SYNTAX=$PUBLISHED_SYNTAX
AUDIT_COMPLETE=$AUDIT_COMPLETE
EOF

cat > "$REPORT" <<EOF
RESULT=$RESULT
STEP_ID=$STEP_ID
SYSTEM_CHANGE=false
RUNTIME_IMPACT=false
R04C_RESULT=PASS_VM130_PUBLISHED_SOURCE_DIFF_AUDIT
LIVE_FILE=$LIVE_FILE
PUBLISHED_FILE=$PUBLISHED_FILE
LIVE_SHA256=$LIVE_SHA256
PUBLISHED_SHA256=$PUBLISHED_SHA256
EXACT_DIFF_SHA256=$EXACT_DIFF_SHA256
STORED_DIFF_MATCH=$STORED_DIFF_MATCH
DIFF_LINE_COUNT=$DIFF_LINE_COUNT
DIFF_HUNK_COUNT=$DIFF_HUNK_COUNT
LIVE_TRYCF_COUNT=$LIVE_TRYCF_COUNT
LIVE_PERMANENT_COUNT=$LIVE_PERMANENT_COUNT
LIVE_SYNTAX=$LIVE_SYNTAX
PUBLISHED_SYNTAX=$PUBLISHED_SYNTAX
AUDIT_COMPLETE=$AUDIT_COMPLETE
EXACT_DIFF=$EXACT_DIFF
LIVE_COPY=$LIVE_COPY
PUBLISHED_COPY=$PUBLISHED_COPY
VERIFY=$VERIFY
FACTS=$FACTS
ROLLBACK=$ROLLBACK
EOF

cat "$REPORT"

echo
echo "=== EXACT ROUTER-PUBLISH-REPORT DIFF BEGIN ==="
cat "$EXACT_DIFF"
echo "=== EXACT ROUTER-PUBLISH-REPORT DIFF END ==="

exit "$RUN_RC"