#!/usr/bin/env bash
set -Eeuo pipefail
LIVE="/opt/router-ops/bin/router-publish-report"
BACKUP="/opt/router-ops/steps/20260715-175201_STEP_DIRECT_HTTPS_INSTALL_PUBLISHER_R04I2/router-publish-report.before"
EXPECTED_BACKUP_SHA256="83582dd85e88032d3aecf8c285cd2ec758a2006ea285fa69c17fa35554a64ea4"
LIVE_MODE="755"
LIVE_UID="1000"
LIVE_GID="1000"
REINDEX="/opt/router-ops/bin/router-public-reindex"
PRIV=()

if [[ ! -w "$(dirname "$LIVE")" ||
      "$(id -u)" != "$LIVE_UID" ]]; then
    PRIV=(sudo -n)
fi

priv() {
    "${PRIV[@]}" "$@"
}

[[ -f "$BACKUP" ]] || {
    echo "RESULT=STOP_ROLLBACK_BACKUP_MISSING"
    exit 20
}

TMP="${LIVE}.rollback.$(date +%s).tmp"
priv install     -o "$LIVE_UID"     -g "$LIVE_GID"     -m "$LIVE_MODE"     "$BACKUP" "$TMP"
priv mv -f "$TMP" "$LIVE"

ACTUAL="$(sha256sum "$LIVE" | awk '{print $1}')"
[[ "$ACTUAL" == "$EXPECTED_BACKUP_SHA256" ]] || {
    echo "RESULT=STOP_ROLLBACK_SHA256_MISMATCH"
    echo "ACTUAL_SHA256=$ACTUAL"
    exit 21
}

sh -n "$LIVE"
"$REINDEX"

echo "RESULT=PASS_PUBLISHER_ROLLBACK"
echo "RESTORED_SHA256=$ACTUAL"
echo "RUNTIME_IMPACT=false"

# Publication-state rollback for this STEP.
PUBLISHED_DIR="/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/latest/20260715-175202_step_direct_https_publisher_install_r04i"
LATEST="/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/latest"
OLD="/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/old"
PUBLISHED_FOLDER="20260715-175202_step_direct_https_publisher_install_r04i"

if [[ -d "$PUBLISHED_DIR" ]]; then
    mv "$PUBLISHED_DIR"        "$OLD/$(date +%Y%m%d-%H%M%S)_rollback_removed_$PUBLISHED_FOLDER"
fi

while IFS= read -r name; do
    [[ -n "$name" ]] || continue
    [[ -d "$OLD/$name" ]] || continue
    mv "$OLD/$name" "$LATEST/$name"
done <<'EOF_MOVED'
20260715-172338_step_direct_https_r04f_candidate_evidence_salvage
EOF_MOVED

"$REINDEX"