#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:?}"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"
STEP=STEP_050M07P21A_R01_VM121_DB_SCHEMA_PROVENANCE_AND_ENCRYPTED_BACKUP_RESTORE

CURRENT="$RUN_DIR/workflow-current.txt"
EVENTS="$RUN_DIR/workflow-events.tsv"
EVIDENCE="$RUN_DIR/evidence"
REPORT="$RUN_DIR/report"
PAYLOAD="$RUN_DIR/public-payload"
FINAL_ENV="$RUN_DIR/final-publication.env"
TARGET_DIR="$RUN_DIR/target"
mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR" "$INCOMING"
chmod 700 "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR"

source "$BASE/lib/router-step-workflow.sh"
router_step_workflow_init "$CURRENT" "$EVENTS" preflight backup restore postcheck report_publish archive

CORE_CHANGE_COMPLETE=false
CORE_CHANGE_REPEATED=false
ROLLBACK_STATUS=not_required
STOP_DETAIL=unknown
STOP_HANDLED=false
LATEST_ARCHIVE=not_created
LATEST_ARCHIVE_SHA256=unknown
STEP_REPORT_URL=unknown
BACKUP_CREATED=false
BACKUP_PATH=unknown
BACKUP_SHA256=unknown
BACKUP_KEY_CREATED=unknown
RESTORE_FIXTURE=unknown
ALEMBIC_VERSION=unknown
DATABASE_SCHEMA_CHANGED=false
LIVE_DATABASE_WRITTEN=false

write_child() {
  local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"
  {
    echo RESULT="$result"
    echo WORKER_RC="$rc"
    echo CORE_CHANGE_COMPLETE="$CORE_CHANGE_COMPLETE"
    echo CORE_CHANGE_REPEATED="$CORE_CHANGE_REPEATED"
    echo ROLLBACK_STATUS="$ROLLBACK_STATUS"
    echo STOP_DETAIL="$STOP_DETAIL"
    echo BACKUP_CREATED="$BACKUP_CREATED"
    echo BACKUP_PATH="$BACKUP_PATH"
    echo BACKUP_SHA256="$BACKUP_SHA256"
    echo BACKUP_KEY_CREATED="$BACKUP_KEY_CREATED"
    echo RESTORE_FIXTURE="$RESTORE_FIXTURE"
    echo ALEMBIC_VERSION="$ALEMBIC_VERSION"
    echo DATABASE_SCHEMA_CHANGED="$DATABASE_SCHEMA_CHANGED"
    echo LIVE_DATABASE_WRITTEN="$LIVE_DATABASE_WRITTEN"
    echo STEP_REPORT_URL="$STEP_REPORT_URL"
    echo LATEST_ARCHIVE="$LATEST_ARCHIVE"
    echo LATEST_ARCHIVE_SHA256="$LATEST_ARCHIVE_SHA256"
  } > "$tmp"
  chmod 600 "$tmp"
  mv "$tmp" "$CHILD_RESULT"
}

archive_latest() {
  local log="$EVIDENCE/archive.log"
  router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"
  LATEST_ARCHIVE="$(awk -F= '$1=="LATEST_ARCHIVE"{print substr($0,index($0,"=")+1)}' "$log" | tail -n1)"
  LATEST_ARCHIVE_SHA256="$(awk -F= '$1=="LATEST_ARCHIVE_SHA256"{print $2}' "$log" | tail -n1)"
}

stop_handler() {
  local rc="$1" line="$2" cmd="$3"
  trap - ERR
  [[ "$STOP_HANDLED" == false ]] || exit "$rc"
  STOP_HANDLED=true
  {
    echo RESULT=STOP_P21A_VM121_DB_SCHEMA_PROVENANCE_AND_ENCRYPTED_BACKUP_RESTORE
    echo STOP_RC="$rc"
    echo STOP_LINE="$line"
    printf 'STOP_COMMAND=%q\n' "$cmd"
    echo CORE_CHANGE_COMPLETE="$CORE_CHANGE_COMPLETE"
    echo CORE_CHANGE_REPEATED="$CORE_CHANGE_REPEATED"
    echo ROLLBACK_STATUS="$ROLLBACK_STATUS"
    echo STOP_DETAIL="$STOP_DETAIL"
    echo BACKUP_CREATED="$BACKUP_CREATED"
    echo BACKUP_PATH="$BACKUP_PATH"
    echo BACKUP_SHA256="$BACKUP_SHA256"
    echo RESTORE_FIXTURE="$RESTORE_FIXTURE"
  } | tee "$REPORT/stop.txt" "$EVIDENCE/stop.txt"
  set +e
  archive_latest >/dev/null 2>&1
  set -e
  write_child STOP_P21A_VM121_DB_SCHEMA_PROVENANCE_AND_ENCRYPTED_BACKUP_RESTORE "$rc"
  exit "$rc"
}
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"' ERR

write_selftest_source() {
  cat <<'EOF'
MODE=--check
MACHINE_ID=vm121
LOCAL_HEAD=25d1656c1ea023b526c7aee0a75327447359de21
REMOTE_HEAD=25d1656c1ea023b526c7aee0a75327447359de21
STAGED_CHANGE_COUNT=0
SIMULATED_TREE_SHA=0ad9296bfc5f2543335cf1d3e082814fc09fcd4a
SIMULATED_TREE_FILE_COUNT=41
RESULT=PASS_VM121_GIT_PUBLISH_CHECK
MACHINE_ID=vm121
GIT_COMMIT=25d1656c1ea023b526c7aee0a75327447359de21
GIT_TREE=0ad9296bfc5f2543335cf1d3e082814fc09fcd4a
GIT_FILE_COUNT=41
COMMIT_CREATED=false
PUSH_PERFORMED=false
EOF
}

collect_source_check() {
  local stage="$1"
  if [[ "$SELFTEST" == true ]]; then
    write_selftest_source > "$EVIDENCE/${stage}-vm121-source.txt"
  else
    ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s >"$EVIDENCE/${stage}-vm121-source.txt" 2>&1 <<'VM121SRC'
set -euo pipefail
/usr/local/sbin/router-vm121-git-publish.sh --check
VM121SRC
  fi
  if ! "$ROOT/scripts/source-check-validate.sh" vm121 "$EVIDENCE/${stage}-vm121-source.txt" \
      25d1656c1ea023b526c7aee0a75327447359de21 \
      0ad9296bfc5f2543335cf1d3e082814fc09fcd4a 41 \
      > "$EVIDENCE/${stage}-vm121-source-validation.txt" 2>&1; then
    STOP_DETAIL="${stage}_vm121_git_semantics"; false
  fi
}

write_selftest_db() {
  local restore="${1:-PASS}"
  cat <<EOF
ALEMBIC_VERSION=0001_initial_schema
PENDING_JOB_COUNT=0
BACKUP_KEY_CREATED=true
BACKUP_KEY_PATH=/root/.config/wg-access/db-backup.pass
BACKUP_PATH=/root/router-db-backups/wg-access-selftest.dump.enc
BACKUP_SHA256=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
BACKUP_SIZE=4096
BACKUP_MODE=600
BACKUP_ENCRYPTION=openssl_aes_256_cbc_pbkdf2_iter_200000
RESTORE_FIXTURE=$restore
RESTORE_ALEMBIC_VERSION=0001_initial_schema
SCHEMA_DDL_SHA256=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
SCHEMA_COLUMNS_SHA256=cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
SCHEMA_INDEXES_SHA256=dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
SCHEMA_CONSTRAINTS_SHA256=eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
LIVE_DRIFT_EGRESS_TABLES_PRESENT=true
LIVE_PARTIAL_ENABLED_TUNNEL_INDEX_PRESENT=true
DATABASE_SCHEMA_CHANGED=false
LIVE_DATABASE_WRITTEN=false
COUNT_users=32
COUNT_invite_codes=2
COUNT_orders=0
COUNT_subscriptions=19
COUNT_peers=0
COUNT_enabled_peers=0
COUNT_disabled_peers=0
COUNT_provisioning_jobs=55
COUNT_egress_targets=5
COUNT_egress_allocator_settings=1
COUNT_peer_egress_leases=0
---BEGIN_TABLES---
alembic_version
egress_allocator_settings
egress_targets
invite_codes
orders
peer_egress_leases
peers
provisioning_jobs
subscriptions
users
---END_TABLES---
---BEGIN_COLUMNS---
peers	id	uuid	uuid	NO	
---END_COLUMNS---
---BEGIN_INDEXES---
peers	uq_peers_node_tunnel_ip_enabled	CREATE UNIQUE INDEX uq_peers_node_tunnel_ip_enabled ON public.peers USING btree (node_id, tunnel_ip) WHERE (enabled = true)
---END_INDEXES---
---BEGIN_CONSTRAINTS---
peers	peers_pkey	p	PRIMARY KEY (id)
---END_CONSTRAINTS---
RESULT=PASS_P21A_VM121_DB_SCHEMA_PROVENANCE_AND_ENCRYPTED_BACKUP_RESTORE
EOF
}

field() {
  local key="$1" file="$2"
  awk -F= -v k="$key" '$1==k{print substr($0,index($0,"=")+1); exit}' "$file"
}

extract_block() {
  local begin="$1" end="$2" src="$3" dest="$4"
  awk -v b="$begin" -v e="$end" '$0==b{inb=1;next}$0==e{inb=0}inb{print}' "$src" > "$dest"
}

router_step_phase_begin preflight
collect_source_check pre
PKG="$ROOT/$(python3 - "$ROOT/release-info.json" <<'PY'
import json,sys
print(json.load(open(sys.argv[1],encoding='utf-8'))['target_package_path'])
PY
)"
PKG_SHA="$(awk '{print $1}' "$ROOT/reference/target-package.sha256")"
"$ROOT/scripts/target-apply.sh" "$PKG_SHA" "$PKG" "$TARGET_DIR" > "$EVIDENCE/target-extract.txt"
router_step_phase_complete preflight vm121_source_and_package_verified

router_step_phase_begin backup
if [[ "$SELFTEST" == true ]]; then
  if [[ "${ROUTER_PUBLIC_ROOT:-}" == */fail/public ]]; then
    write_selftest_db FAIL > "$EVIDENCE/db-foundation.txt"
  else
    write_selftest_db PASS > "$EVIDENCE/db-foundation.txt"
  fi
else
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s \
    < "$TARGET_DIR/vm121-db-provenance-backup.sh" \
    > "$EVIDENCE/db-foundation.txt" 2>&1
fi
BACKUP_PATH="$(field BACKUP_PATH "$EVIDENCE/db-foundation.txt")"
BACKUP_SHA256="$(field BACKUP_SHA256 "$EVIDENCE/db-foundation.txt")"
BACKUP_KEY_CREATED="$(field BACKUP_KEY_CREATED "$EVIDENCE/db-foundation.txt")"
ALEMBIC_VERSION="$(field ALEMBIC_VERSION "$EVIDENCE/db-foundation.txt")"
RESTORE_FIXTURE="$(field RESTORE_FIXTURE "$EVIDENCE/db-foundation.txt")"
DATABASE_SCHEMA_CHANGED="$(field DATABASE_SCHEMA_CHANGED "$EVIDENCE/db-foundation.txt")"
LIVE_DATABASE_WRITTEN="$(field LIVE_DATABASE_WRITTEN "$EVIDENCE/db-foundation.txt")"
[[ -n "$BACKUP_PATH" && -n "$BACKUP_SHA256" ]] && BACKUP_CREATED=true
router_step_phase_complete backup encrypted_backup_created

router_step_phase_begin restore
if ! "$ROOT/scripts/db-foundation-validate.sh" "$EVIDENCE/db-foundation.txt" \
    > "$EVIDENCE/db-foundation-validation.txt" 2>&1; then
  STOP_DETAIL=restore_fixture
  false
fi
router_step_phase_complete restore encrypted_backup_restore_verified

router_step_phase_begin postcheck
collect_source_check post
cmp -s "$EVIDENCE/pre-vm121-source-validation.txt" "$EVIDENCE/post-vm121-source-validation.txt" || {
  STOP_DETAIL=vm121_source_changed
  false
}
CORE_CHANGE_COMPLETE=true
router_step_phase_complete postcheck source_unchanged_and_restore_proven

extract_block '---BEGIN_TABLES---' '---END_TABLES---' "$EVIDENCE/db-foundation.txt" "$REPORT/schema-tables.txt"
extract_block '---BEGIN_COLUMNS---' '---END_COLUMNS---' "$EVIDENCE/db-foundation.txt" "$REPORT/schema-columns.tsv"
extract_block '---BEGIN_INDEXES---' '---END_INDEXES---' "$EVIDENCE/db-foundation.txt" "$REPORT/schema-indexes.tsv"
extract_block '---BEGIN_CONSTRAINTS---' '---END_CONSTRAINTS---' "$EVIDENCE/db-foundation.txt" "$REPORT/schema-constraints.tsv"
grep '^COUNT_' "$EVIDENCE/db-foundation.txt" > "$REPORT/db-counts.txt"

cat > "$REPORT/report.txt" <<EOF
RESULT=PASS_P21A_VM121_DB_SCHEMA_PROVENANCE_AND_ENCRYPTED_BACKUP_RESTORE
REVISION=R01
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
MACHINE_GIT_CLOSE_RUN=false
DATABASE_SCHEMA_CHANGED=false
LIVE_DATABASE_WRITTEN=false
VM100_CHANGED=false
VM101_CHANGED=false
REBOOT_PERFORMED=false
SNAPSHOT_CREATED=false
BACKUP_CREATED=$BACKUP_CREATED
BACKUP_ENCRYPTED=true
BACKUP_PATH=$BACKUP_PATH
BACKUP_SHA256=$BACKUP_SHA256
BACKUP_KEY_CREATED=$BACKUP_KEY_CREATED
BACKUP_KEY_PUBLISHED=false
RESTORE_FIXTURE=$RESTORE_FIXTURE
ALEMBIC_VERSION=$ALEMBIC_VERSION
LIVE_DRIFT_EGRESS_TABLES_PRESENT=true
LIVE_PARTIAL_ENABLED_TUNNEL_INDEX_PRESENT=true
VM121_COMMIT=25d1656c1ea023b526c7aee0a75327447359de21
VM121_TREE=0ad9296bfc5f2543335cf1d3e082814fc09fcd4a
VM121_FILE_COUNT=41
VM121_PUBLIC_URL=https://reports.secret-studio.ru/latest/20260808-081225_vm121_git_source_25d1656c1ea0/
VM100_PUBLIC_URL=https://reports.secret-studio.ru/latest/20260809-142753_vm100_git_source_e865282f4837/
VM101_PUBLIC_URL=https://reports.secret-studio.ru/latest/20260801-095331_vm101_git_source_ac678d1b3164/
PROJECT_SOURCE_POST_URL=https://reports.secret-studio.ru/latest/20260802-105248_project_source_post_r20qx_vm121_multi_protocol_architecture/
GLOBAL_PLAN_URL=https://reports.secret-studio.ru/latest/20260802-105248_global_project_plan_wg_paid_after_r20qw/
ACCESS_MAP_URL=https://reports.secret-studio.ru/latest/20260715-210236_access_map_canonical_current/
RUNTIME_IMPACT=false
COPY_VERIFY=PASS
NEXT_ACTION=P2.1B build bridge migration from exact captured schema; fixture current-live clone and clean install before any live schema apply
EOF
cp "$REPORT/report.txt" "$REPORT/verify.txt"
cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
cp "$ROOT/release-info.json" "$REPORT/release-info.json"
cp "$ROOT/manifest.sha256" "$REPORT/bundle-manifest.sha256"
cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
cp "$EVIDENCE/pre-vm121-source-validation.txt" "$REPORT/"
cp "$EVIDENCE/post-vm121-source-validation.txt" "$REPORT/"
cp "$EVIDENCE/db-foundation-validation.txt" "$REPORT/"

router_step_phase_begin report_publish
if [[ "$SELFTEST" == true ]]; then
  DEST="${ROUTER_PUBLIC_ROOT:?}/latest/p21a-r01-selftest"
  rm -rf "$DEST"
  mkdir -p "$DEST"
  cp -a "$REPORT"/. "$DEST"/
  STEP_REPORT_URL=selftest://p21a-r01/
else
  args=()
  while IFS= read -r file; do args+=("$file" "$(basename "$file")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
  router_step_publish_payload step050m07p21a_r01_vm121_db_schema_provenance_encrypted_backup_restore \
    "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"
  STEP_REPORT_URL="$(awk -F= '$1=="PUBLIC_URL"{print substr($0,index($0,"=")+1)}' "$FINAL_ENV" | tail -n1)"
fi
router_step_phase_complete report_publish step_report_published

router_step_phase_begin archive
archive_latest
router_step_phase_complete archive latest_created
router_step_workflow_mark_complete

trap - ERR
STOP_DETAIL=none
write_child PASS_P21A_VM121_DB_SCHEMA_PROVENANCE_AND_ENCRYPTED_BACKUP_RESTORE 0
cat "$REPORT/report.txt"
echo STEP_REPORT_URL="$STEP_REPORT_URL"
echo LATEST_ARCHIVE="$LATEST_ARCHIVE"
echo LATEST_ARCHIVE_SHA256="$LATEST_ARCHIVE_SHA256"