#!/usr/bin/env bash
set -Eeuo pipefail
[[ "$#" -ge 3 && "$#" -le 4 ]] || { echo 'Usage: router-step-bootstrap ZIP ZIP_SHA256 INSTALLER_SHA256 [TARGET_PACKAGE_SHA256]' >&2; exit 2; }
ZIP="$1"; ZIP_SHA="$2"; INSTALL_SHA="$3"; TARGET_SHA="${4:-}"
[[ -f "$ZIP" ]] || { echo RESULT=STOP_COPY_OR_TRANSFER_ERROR; echo COPY_VERIFY=FAIL; echo STEP_WAS_NOT_STARTED=true; exit 20; }
STEP="$(basename "$ZIP" .zip)"; WORK="$(dirname "$ZIP")/.unpack-${STEP}-$$"
cleanup(){ rc=$?; trap - EXIT INT TERM HUP; [[ "$rc" -eq 0 ]] && rm -rf "$WORK"; exit "$rc"; }; trap cleanup EXIT INT TERM HUP
echo '>>> verify ZIP'; echo "$ZIP_SHA  $ZIP" | sha256sum -c -; rm -rf "$WORK"; mkdir -p "$WORK"
python3 - "$ZIP" "$WORK" "$STEP" <<'PYZIP'
import sys,zipfile
from pathlib import Path
z=Path(sys.argv[1]); d=Path(sys.argv[2]).resolve(); expected=sys.argv[3]
with zipfile.ZipFile(z) as f:
    roots=set()
    for m in f.infolist():
        n=m.filename.replace('\\','/'); parts=Path(n).parts
        if not parts: continue
        if n.startswith('/') or '..' in parts or ':' in parts[0]: raise SystemExit(f'unsafe ZIP member: {m.filename}')
        roots.add(parts[0]); target=(d/n).resolve()
        if target!=d and d not in target.parents: raise SystemExit(f'ZIP escape: {m.filename}')
    if roots!={expected}: raise SystemExit(f'unexpected ZIP roots: {sorted(roots)}')
    f.extractall(d)
PYZIP
DIR="$WORK/$STEP"; [[ -f "$DIR/install.sh" && -f "$DIR/manifest.sha256" && -f "$DIR/release-info.json" ]]
while IFS= read -r -d '' file; do first="$(head -n1 "$file" 2>/dev/null || true)"; case "$first" in '#!/usr/bin/env bash'|'#!/bin/bash') chmod 700 "$file"; bash -n "$file";; '#!/bin/sh'|'#!/bin/ash') chmod 700 "$file"; sh -n "$file";; '#!/usr/bin/env python3'|'#!/usr/bin/python3') chmod 700 "$file"; python3 -m py_compile "$file";; esac; done < <(find "$DIR" -type f -print0)
find "$DIR" -type d -name __pycache__ -prune -exec rm -rf {} + 2>/dev/null || true
(cd "$DIR" && sha256sum -c manifest.sha256)
[[ "$(sha256sum "$DIR/install.sh"|awk '{print $1}')" == "$INSTALL_SHA" ]]
python3 - "$DIR/release-info.json" "$STEP" "$INSTALL_SHA" "$TARGET_SHA" <<'PYMETA'
import json,sys
p,step,ish,tsh=sys.argv[1:]; x=json.load(open(p,encoding='utf-8')); assert x['step_id']==step; assert x['expected_installer_sha256']==ish
if tsh: assert x.get('target_package_sha256')==tsh
PYMETA
BUNDLE_ROOT="$DIR" /opt/router-ops/bin/router-bundle-gate "$DIR"
echo MANIFEST_VERIFY=PASS; echo SYNTAX_VERIFY=PASS; echo FIXTURE_VERIFY=PASS; echo COPY_VERIFY=PASS; echo "STEP_SHA256=$INSTALL_SHA"; echo ">>> start $STEP"
set +e; BUNDLE_ZIP="$ZIP" EXPECTED_BUNDLE_SHA256="$ZIP_SHA" EXPECTED_INSTALLER_SHA256="$INSTALL_SHA" "$DIR/install.sh"; rc=$?; set -e
echo "BOOTSTRAP_INSTALLER_RC=$rc"; exit "$rc"
