#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
ROOT="${BUNDLE_ROOT:?}"
RUN_DIR="${ROUTER_DETACHED_RUN_DIR:?}"
CHILD_RESULT="${ROUTER_DETACHED_CHILD_RESULT:?}"
INCOMING="${ROUTER_STEP_INCOMING:-/home/ops/incoming}"
SELFTEST="${ROUTER_EXACT_WORKER_SELFTEST:-false}"

STEP=STEP_050M07P26C3A_R01_SMTP_TLS_AND_DURABLE_ADMIN_SECRET_FOUNDATION
VM121_BASE_COMMIT=9bbb2aeacd669698055121a0f4fbaf5aa67720db
VM121_BASE_TREE=f83f404ca097962b1d407ad5b3c32da96acd4ee4
VM121_BASE_COUNT=51
VM100_PUBLIC_URL=https://reports.secret-studio.ru/latest/20260816-094040_vm100_git_source_8c5d11b7e4b1/
VM101_PUBLIC_URL=https://reports.secret-studio.ru/latest/20260816-094047_vm101_git_source_94a1c5627bac/
VM121_PUBLIC_URL=https://reports.secret-studio.ru/latest/20260817-091131_vm121_git_source_9bbb2aeacd66/
P26_REPORT_URL=https://reports.secret-studio.ru/latest/20260817-082619_step050m07p26_r03_invite_magic_link_secure_session_mvp/
P26C1_REPORT_URL=https://reports.secret-studio.ru/latest/20260817-091137_step050m07p26c1_r03_wireguard_config_qr_revoke_reissue_surface/
P26C2_REPORT_URL=https://reports.secret-studio.ru/latest/20260817-184037_step050m07p26c2_r03_controlled_live_external_wireguard_proof/
LOCAL_PLAN_URL=https://reports.secret-studio.ru/latest/20260719-080444_local_architecture_plan_vm101_autonomous_hmn_recovery_r19/
GLOBAL_PLAN_URL=https://reports.secret-studio.ru/latest/20260802-105248_global_project_plan_wg_paid_after_r20qw/
ACCESS_MAP_URL=https://reports.secret-studio.ru/latest/20260812-153301_access_map_canonical_current/

CURRENT="$RUN_DIR/workflow-current.txt"
EVENTS="$RUN_DIR/workflow-events.tsv"
EVIDENCE="$RUN_DIR/evidence"
REPORT="$RUN_DIR/report"
PAYLOAD="$RUN_DIR/public-payload"
FINAL_ENV="$RUN_DIR/final-publication.env"
TARGET_DIR="$RUN_DIR/target"
mkdir -p "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR" "$INCOMING"
chmod 700 "$EVIDENCE" "$REPORT" "$PAYLOAD" "$TARGET_DIR"

source "$BASE/lib/router-step-workflow.sh"
source <("$BASE/bin/router-release-contract" env --root "$ROOT")
router_step_workflow_init "$CURRENT" "$EVENTS" preflight backup apply isolated_test machine_close postcheck report_publish archive

CORE_CHANGE_COMPLETE=false
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=false
SOURCE_APPLIED=false
BACKUP_READY=false
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
LIVE_ENV_UNCHANGED=unknown
EXTERNAL_ONBOARDING_ACTIVE=false
SMTP_TLS_IMPLEMENTED=false
SMTP_TLS_DELIVERY_ACTIVE=false
SMTP_SECRET_PROVISIONED=false
DURABLE_ADMIN_AUTH_IMPLEMENTED=false
DURABLE_ADMIN_AUTH_ACTIVE=false
ADMIN_SECRET_PROVISIONED=false
BACKUP_DIR=unknown
STOP_DETAIL=unknown
STOP_HANDLED=false
STEP_REPORT_URL=unknown
LATEST_ARCHIVE=not_created
LATEST_ARCHIVE_SHA256=unknown
XS_MAP_URL=unknown
VM121_COMMIT="$VM121_BASE_COMMIT"
VM121_TREE="$VM121_BASE_TREE"
VM121_COUNT="$VM121_BASE_COUNT"
REMOTE_PKG=unknown
REMOTE_TEST=unknown
PRE_ENV_SHA=unknown
POST_ENV_SHA=unknown
BACKEND_STARTED_BEFORE=unknown
BACKEND_STARTED_AFTER=unknown

last_field() {
  local key="$1" file="$2"
  awk -F= -v k="$key" '$1==k{v=substr($0,index($0,"=")+1)} END{print v}' "$file"
}

write_child() {
  local result="$1" rc="$2" tmp="${CHILD_RESULT}.tmp.$$"
  {
    echo "RESULT=$result"
    echo "WORKER_RC=$rc"
    echo "CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE"
    echo "CORE_CHANGE_REPEATED=false"
    echo "SOURCE_CHANGED=$SOURCE_CHANGED"
    echo "LIVE_DATABASE_WRITTEN=false"
    echo "DATABASE_SCHEMA_CHANGED=false"
    echo "EXTERNAL_ONBOARDING_ACTIVE=false"
    echo "SMTP_TLS_DELIVERY_ACTIVE=false"
    echo "SMTP_SECRET_PROVISIONED=false"
    echo "ADMIN_SECRET_PROVISIONED=false"
    echo "BACKUP_DIR=$BACKUP_DIR"
    echo "VM121_COMMIT=$VM121_COMMIT"
    echo "VM121_TREE=$VM121_TREE"
    echo "VM121_FILE_COUNT=$VM121_COUNT"
    echo "VM121_PUBLIC_URL=$VM121_PUBLIC_URL"
    echo "STEP_REPORT_URL=$STEP_REPORT_URL"
    echo "LATEST_ARCHIVE=$LATEST_ARCHIVE"
    echo "LATEST_ARCHIVE_SHA256=$LATEST_ARCHIVE_SHA256"
  } > "$tmp"
  chmod 600 "$tmp"
  mv "$tmp" "$CHILD_RESULT"
}

archive_latest() {
  local log="$EVIDENCE/archive.log"
  router_step_archive_latest_python "$BASE" "$INCOMING" "$(date -u +%Y%m%d-%H%M%S)" | tee "$log"
  LATEST_ARCHIVE="$(last_field LATEST_ARCHIVE "$log")"
  LATEST_ARCHIVE_SHA256="$(last_field LATEST_ARCHIVE_SHA256 "$log")"
}

resolve_xs_map() {
  local f=/opt/router-ops/inventory/XS_MAP_CURRENT.md u=''
  if [[ -r "$f" ]]; then
    u="$(grep -Eo 'https://reports\.secret-studio\.ru/[^[:space:]`)]+' "$f" 2>/dev/null | tail -n1 || true)"
  fi
  [[ -n "$u" ]] && XS_MAP_URL="$u" || XS_MAP_URL=unknown
}

cleanup_remote() {
  [[ "$SELFTEST" == false ]] || return 0
  set +e
  [[ "$REMOTE_TEST" == unknown ]] || ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "docker exec wgaccess-backend rm -f /tmp/p26c3a_security_test.py >/dev/null 2>&1 || true; rm -f '$REMOTE_TEST'" >/dev/null 2>&1 || true
  [[ "$REMOTE_PKG" == unknown ]] || ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "rm -f '$REMOTE_PKG'" >/dev/null 2>&1 || true
  set -e
}

rollback_now() {
  [ "$BACKUP_READY" = true ] || return 0
  [[ "$CORE_CHANGE_COMPLETE" == false ]] || return 0
  set +e
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s -- "$BACKUP_DIR" > "$EVIDENCE/rollback.txt" 2>&1 <<'VM121_ROLLBACK'
set -Eeuo pipefail
BACKUP_DIR="${1:?}"
ARCHIVE="$BACKUP_DIR/source-before.tar.gz"
test -f "$ARCHIVE"
rm -f /opt/wg-access/backend/app/services/admin_auth.py
rm -f /opt/wg-access/backend/app/services/mail_delivery.py
tar -xzf "$ARCHIVE" -C /
cd /opt/wg-access
docker compose up -d --force-recreate backend >/dev/null
for i in $(seq 1 120); do
  if curl -fsS --max-time 3 http://127.0.0.1:18080/health >/dev/null 2>&1 && curl -fsS --max-time 3 http://127.0.0.1:18080/health/db >/dev/null 2>&1; then
    echo BACKEND_RECOVERY_HEALTH=PASS
    exit 0
  fi
  sleep 1
  [[ "$i" -lt 120 ]]
done
echo BACKEND_RECOVERY_HEALTH=FAIL
exit 1
VM121_ROLLBACK
  local rrc=$?
  if [[ "$rrc" -eq 0 ]]; then
    SOURCE_CHANGED=false
    SOURCE_APPLIED=false
  fi
  set -e
  return "$rrc"
}

write_stop_report() {
  local rc="$1" line="$2" command="$3"
  cat > "$REPORT/report.txt" <<EOFSTOP
RESULT=STOP_P26C3A_SMTP_TLS_AND_DURABLE_ADMIN_SECRET_FOUNDATION
REVISION=R01
STOP_RC=$rc
STOP_LINE=$line
STOP_DETAIL=$STOP_DETAIL
CORE_CHANGE_COMPLETE=$CORE_CHANGE_COMPLETE
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=$SOURCE_CHANGED
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
LIVE_ENV_UNCHANGED=$LIVE_ENV_UNCHANGED
EXTERNAL_ONBOARDING_ACTIVE=false
SMTP_TLS_DELIVERY_ACTIVE=false
SMTP_SECRET_PROVISIONED=false
ADMIN_SECRET_PROVISIONED=false
BACKUP_DIR=$BACKUP_DIR
VM121_COMMIT=$VM121_COMMIT
VM121_TREE=$VM121_TREE
VM121_FILE_COUNT=$VM121_COUNT
VM121_PUBLIC_URL=$VM121_PUBLIC_URL
P26C2_REPORT_URL=$P26C2_REPORT_URL
ACCESS_MAP_URL=$ACCESS_MAP_URL
NEXT_ACTION=inspect retained evidence; if CORE_CHANGE_COMPLETE=true continue post-core without restoring accepted source
EOFSTOP
  printf 'STOP_COMMAND=%q\n' "$command" >> "$REPORT/report.txt"
  cp "$REPORT/report.txt" "$REPORT/verify.txt"
  cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
  cp "$ROOT/release-info.json" "$REPORT/release-info.json"
  cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
  for f in pre-vm121-source-validation.txt pre-vm121-live.txt pre-source-sha.txt backup.txt apply.txt generation.txt production-gate.txt security-foundation-e2e.txt production-after-isolated.txt machine-close.txt post-vm121-source-validation.txt post-vm121-live.txt rollback.txt; do
    [[ ! -f "$EVIDENCE/$f" ]] || cp "$EVIDENCE/$f" "$REPORT/$f"
  done
}

stop_handler() {
  local rc="$1" line="$2" command="$3"
  trap - ERR
  [[ "$STOP_HANDLED" == false ]] || return "$rc"
  STOP_HANDLED=true
  if [[ "$CORE_CHANGE_COMPLETE" == false && "$BACKUP_READY" == true ]]; then rollback_now || true; fi
  cleanup_remote
  resolve_xs_map
  write_stop_report "$rc" "$line" "$command"
  set +e
  if [[ "$SELFTEST" == false ]]; then
    local args=()
    while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
    router_step_publish_payload step050m07p26c3a_r01_smtp_tls_and_durable_admin_secret_foundation_stop \
      "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}" >/dev/null 2>&1 || true
    [[ -f "$FINAL_ENV" ]] && STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"
    archive_latest >/dev/null 2>&1 || true
  fi
  set -e
  write_child STOP_P26C3A_SMTP_TLS_AND_DURABLE_ADMIN_SECRET_FOUNDATION "$rc"
  return "$rc"
}
trap 'rc=$?; stop_handler "$rc" "$LINENO" "$BASH_COMMAND"; exit "$rc"' ERR

selftest_worker() {
  local pkg="$ROOT/$ROUTER_RELEASE_TARGET_PACKAGE_PATH" sha
  sha="$(sha256sum "$pkg" | awk '{print $1}')"
  [[ "$sha" == "$ROUTER_RELEASE_TARGET_PACKAGE_SHA256" ]]
  tar -tzf "$pkg" > "$TARGET_DIR/package-list.txt"
  for rel in \
    opt/wg-access/.env.example \
    opt/wg-access/backend/app/config.py \
    opt/wg-access/backend/app/api/auth_v2.py \
    opt/wg-access/backend/app/services/admin_auth.py \
    opt/wg-access/backend/app/services/mail_delivery.py; do
    grep -Fqx "$rel" "$TARGET_DIR/package-list.txt"
  done
  [[ "$(wc -l < "$TARGET_DIR/package-list.txt")" -eq 5 ]]
  mkdir -p "$TARGET_DIR/extract"
  tar -xzf "$pkg" -C "$TARGET_DIR/extract"
  python3 -m py_compile \
    "$TARGET_DIR/extract/opt/wg-access/backend/app/config.py" \
    "$TARGET_DIR/extract/opt/wg-access/backend/app/api/auth_v2.py" \
    "$TARGET_DIR/extract/opt/wg-access/backend/app/services/admin_auth.py" \
    "$TARGET_DIR/extract/opt/wg-access/backend/app/services/mail_delivery.py"
  python3 - "$ROOT/payload/p26c3a_security_test.py" <<'PYCOMPILE'
from pathlib import Path
import sys
p=Path(sys.argv[1]); compile(p.read_bytes(), str(p), 'exec')
PYCOMPILE
  grep -Fq 'TRANSITION_DIR="$(mktemp -d /tmp/p26c3a-r01-runtime-transition.XXXXXX)"' "$ROOT/install.sh"
  ! grep -Eq 'TRANSITION="/tmp/' "$ROOT/install.sh"
  grep -Fq 'LIVE_DATABASE_WRITTEN=false' "$ROOT/scripts/run-step.sh"
  echo RESULT=PASS_P26C3A_R01_EXACT_WORKER_SELFTEST
  write_child PASS_P26C3A_R01_EXACT_WORKER_SELFTEST 0
}

if [[ "$SELFTEST" == true ]]; then
  selftest_worker
  trap - ERR
  exit 0
fi

collect_vm121_live() {
  local outfile="$1"
  ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s > "$outfile" 2>&1 <<'VM121_LIVE'
set -Eeuo pipefail
curl -fsS --max-time 5 http://127.0.0.1:18080/health >/dev/null
curl -fsS --max-time 5 http://127.0.0.1:18080/health/db >/dev/null
PG=wgaccess-postgres
U="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_USER"')"
D="$(docker exec "$PG" sh -lc 'printf %s "$POSTGRES_DB"')"
Q(){ docker exec "$PG" psql -v ON_ERROR_STOP=1 -U "$U" -d "$D" -Atqc "$1"; }
echo BACKEND_HEALTH=PASS
echo "ALEMBIC_VERSION=$(Q 'SELECT version_num FROM alembic_version')"
echo "USER_ROWS=$(Q 'SELECT count(*) FROM users')"
echo "INVITE_ROWS=$(Q 'SELECT count(*) FROM invites')"
echo "MAGIC_LINK_ROWS=$(Q 'SELECT count(*) FROM magic_link_tokens')"
echo "AUTH_SESSION_ROWS=$(Q 'SELECT count(*) FROM auth_sessions')"
echo "AUDIT_EVENT_ROWS=$(Q 'SELECT count(*) FROM audit_events')"
echo "CONNECTION_PROFILE_ROWS=$(Q 'SELECT count(*) FROM connection_profiles')"
echo "PEER_CREDENTIAL_ROWS=$(Q 'SELECT count(*) FROM peer_credentials')"
echo "PROVISIONING_JOB_ROWS=$(Q 'SELECT count(*) FROM provisioning_jobs')"
echo "LIVE_ENV_SHA256=$(sha256sum /opt/wg-access/.env | awk '{print $1}')"
echo "BACKEND_STARTED_AT=$(docker inspect -f '{{.State.StartedAt}}' wgaccess-backend)"
docker exec -i wgaccess-backend python - <<'PY'
from app.config import settings
print('EXTERNAL_ONBOARDING_ACTIVE='+str(bool(settings.external_onboarding_active)).lower())
print('AUTH_ADMIN_ENV_FALLBACK='+str(bool(getattr(settings,'auth_admin_token_env_fallback',False))).lower())
print('SMTP_DELIVERY_ACTIVE='+str(bool(getattr(settings,'smtp_delivery_active',False))).lower())
try:
    from app.services.admin_auth import admin_authorization_status
    s=admin_authorization_status()
    print('DURABLE_ADMIN_MODULE_PRESENT=true')
    print('ADMIN_AUTH_CONFIGURED='+str(bool(s['configured'])).lower())
    print('ADMIN_AUTH_SOURCE='+str(s['source']))
except ModuleNotFoundError:
    print('DURABLE_ADMIN_MODULE_PRESENT=false')
try:
    from app.services.mail_delivery import smtp_delivery_status
    s=smtp_delivery_status()
    print('SMTP_DELIVERY_MODULE_PRESENT=true')
    print('SMTP_DELIVERY_CONFIGURED='+str(bool(s['configured'])).lower())
    print('SMTP_SECURITY='+str(s['security']))
except ModuleNotFoundError:
    print('SMTP_DELIVERY_MODULE_PRESENT=false')
PY
VM121_LIVE
}

assert_prod_zero() {
  local file="$1"
  [[ "$(last_field ALEMBIC_VERSION "$file")" == 0004_profile_provisioning ]]
  for key in USER_ROWS INVITE_ROWS MAGIC_LINK_ROWS AUTH_SESSION_ROWS AUDIT_EVENT_ROWS CONNECTION_PROFILE_ROWS PEER_CREDENTIAL_ROWS PROVISIONING_JOB_ROWS; do
    [[ "$(last_field "$key" "$file")" == 0 ]]
  done
}

router_step_phase_begin preflight
ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /usr/local/sbin/router-vm121-git-publish.sh --check > "$EVIDENCE/pre-vm121-source.txt" 2>&1
"$ROOT/scripts/source-check-validate.sh" "$EVIDENCE/pre-vm121-source.txt" vm121 "$VM121_BASE_COMMIT" "$VM121_BASE_TREE" "$VM121_BASE_COUNT" > "$EVIDENCE/pre-vm121-source-validation.txt" || { STOP_DETAIL=pre_vm121_source; false; }
collect_vm121_live "$EVIDENCE/pre-vm121-live.txt" || { STOP_DETAIL=pre_vm121_live; false; }
assert_prod_zero "$EVIDENCE/pre-vm121-live.txt" || { STOP_DETAIL=pre_prod_state_not_zero; false; }
[[ "$(last_field EXTERNAL_ONBOARDING_ACTIVE "$EVIDENCE/pre-vm121-live.txt")" == false ]] || { STOP_DETAIL=pre_external_onboarding_enabled; false; }
PRE_ENV_SHA="$(last_field LIVE_ENV_SHA256 "$EVIDENCE/pre-vm121-live.txt")"
BACKEND_STARTED_BEFORE="$(last_field BACKEND_STARTED_AT "$EVIDENCE/pre-vm121-live.txt")"
ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 'sha256sum -c -' < "$ROOT/reference/pre-source.sha256" > "$EVIDENCE/pre-source-sha.txt" 2>&1 || { STOP_DETAIL=pre_source_file_hash; false; }
ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 'test ! -e /opt/wg-access/backend/app/services/admin_auth.py && test ! -e /opt/wg-access/backend/app/services/mail_delivery.py' || { STOP_DETAIL=pre_new_service_already_present; false; }
PKG="$ROOT/$ROUTER_RELEASE_TARGET_PACKAGE_PATH"
[[ "$(sha256sum "$PKG" | awk '{print $1}')" == "$ROUTER_RELEASE_TARGET_PACKAGE_SHA256" ]] || { STOP_DETAIL=target_package_sha; false; }
[[ "$(tar -tzf "$PKG" | wc -l)" -eq 5 ]] || { STOP_DETAIL=target_package_member_count; false; }
router_step_phase_complete preflight exact_vm121_source_prod_zero_external_closed_candidate_verified

router_step_phase_begin backup
token="$(basename "$RUN_DIR" | tr -cd 'A-Za-z0-9._-')"
BACKUP_DIR="/root/router-ops-backups/p26c3a-r01-$token"
REMOTE_PKG="/root/router-step-p26c3a-r01-$token.tar.gz"
REMOTE_TEST="/root/router-step-p26c3a-r01-$token-security-test.py"
ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s -- "$BACKUP_DIR" > "$EVIDENCE/backup.txt" 2>&1 <<'VM121_BACKUP'
set -Eeuo pipefail
BACKUP_DIR="${1:?}"
mkdir -p "$BACKUP_DIR"; chmod 700 "$BACKUP_DIR"
tar -czf "$BACKUP_DIR/source-before.tar.gz" -C / \
  opt/wg-access/.env.example \
  opt/wg-access/backend/app/config.py \
  opt/wg-access/backend/app/api/auth_v2.py
chmod 600 "$BACKUP_DIR/source-before.tar.gz"
echo SOURCE_BACKUP_PRESENT=true
echo BACKUP_DIR="$BACKUP_DIR"
VM121_BACKUP
BACKUP_READY=true
router_step_phase_complete backup affected_source_backed_up

router_step_phase_begin apply
EXPECTED_PACKAGE_SHA="${ROUTER_RELEASE_TARGET_PACKAGE_SHA256}"
ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "cat > '$REMOTE_PKG' && chmod 600 '$REMOTE_PKG'" < "$PKG"
ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s -- "$REMOTE_PKG" "$EXPECTED_PACKAGE_SHA" > "$EVIDENCE/apply.txt" 2>&1 <<'VM121_APPLY'
set -Eeuo pipefail
PKG="${1:?}"
EXPECTED_PACKAGE_SHA="${2:?}"
[[ "$(sha256sum "$PKG" | awk '{print $1}')" == "$EXPECTED_PACKAGE_SHA" ]]
tar -xzf "$PKG" -C /
chmod 0644 \
  /opt/wg-access/.env.example \
  /opt/wg-access/backend/app/config.py \
  /opt/wg-access/backend/app/api/auth_v2.py \
  /opt/wg-access/backend/app/services/admin_auth.py \
  /opt/wg-access/backend/app/services/mail_delivery.py
python3 -m py_compile \
  /opt/wg-access/backend/app/config.py \
  /opt/wg-access/backend/app/api/auth_v2.py \
  /opt/wg-access/backend/app/services/admin_auth.py \
  /opt/wg-access/backend/app/services/mail_delivery.py
cd /opt/wg-access
docker compose up -d --force-recreate backend >/dev/null
for i in $(seq 1 120); do
  if curl -fsS --max-time 3 http://127.0.0.1:18080/health >/dev/null 2>&1 && curl -fsS --max-time 3 http://127.0.0.1:18080/health/db >/dev/null 2>&1; then
    echo SOURCE_APPLY=PASS
    exit 0
  fi
  sleep 1
  [[ "$i" -lt 120 ]]
done
exit 1
VM121_APPLY
SOURCE_CHANGED=true
SOURCE_APPLIED=true
collect_vm121_live "$EVIDENCE/production-gate.txt" || { STOP_DETAIL=production_gate; false; }
assert_prod_zero "$EVIDENCE/production-gate.txt" || { STOP_DETAIL=production_db_changed_on_apply; false; }
POST_ENV_SHA="$(last_field LIVE_ENV_SHA256 "$EVIDENCE/production-gate.txt")"
[[ "$POST_ENV_SHA" == "$PRE_ENV_SHA" ]] || { STOP_DETAIL=live_env_changed_on_apply; false; }
LIVE_ENV_UNCHANGED=true
BACKEND_STARTED_AFTER="$(last_field BACKEND_STARTED_AT "$EVIDENCE/production-gate.txt")"
[[ "$BACKEND_STARTED_AFTER" != "$BACKEND_STARTED_BEFORE" ]] || { STOP_DETAIL=backend_generation_not_changed; false; }
[[ "$(last_field EXTERNAL_ONBOARDING_ACTIVE "$EVIDENCE/production-gate.txt")" == false ]] || { STOP_DETAIL=external_onboarding_enabled; false; }
[[ "$(last_field AUTH_ADMIN_ENV_FALLBACK "$EVIDENCE/production-gate.txt")" == false ]] || { STOP_DETAIL=admin_env_fallback_enabled; false; }
[[ "$(last_field SMTP_DELIVERY_ACTIVE "$EVIDENCE/production-gate.txt")" == false ]] || { STOP_DETAIL=smtp_delivery_unexpectedly_active; false; }
[[ "$(last_field DURABLE_ADMIN_MODULE_PRESENT "$EVIDENCE/production-gate.txt")" == true ]] || { STOP_DETAIL=admin_module_missing; false; }
[[ "$(last_field SMTP_DELIVERY_MODULE_PRESENT "$EVIDENCE/production-gate.txt")" == true ]] || { STOP_DETAIL=smtp_module_missing; false; }
SMTP_TLS_IMPLEMENTED=true
DURABLE_ADMIN_AUTH_IMPLEMENTED=true
router_step_phase_complete apply source_installed_backend_generation_changed_production_still_closed

router_step_phase_begin isolated_test
ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 "cat > '$REMOTE_TEST' && chmod 600 '$REMOTE_TEST'" < "$ROOT/payload/p26c3a_security_test.py"
ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /bin/bash -s -- "$REMOTE_TEST" > "$EVIDENCE/security-foundation-e2e.txt" 2>&1 <<'VM121_TEST'
set -Eeuo pipefail
TEST="${1:?}"
docker cp "$TEST" wgaccess-backend:/tmp/p26c3a_security_test.py
docker exec wgaccess-backend python /tmp/p26c3a_security_test.py
rc=$?
docker exec wgaccess-backend rm -f /tmp/p26c3a_security_test.py >/dev/null 2>&1 || true
exit "$rc"
VM121_TEST
for kv in \
  'ADMIN_FILE_AUTHORIZATION=PASS' \
  'ADMIN_FILE_MODE_FAIL_CLOSED=PASS' \
  'ADMIN_ENV_FALLBACK_EXPLICIT_ONLY=PASS' \
  'SMTP_STARTTLS_STRICT_VERIFICATION=PASS' \
  'SMTP_IMPLICIT_TLS_STRICT_VERIFICATION=PASS' \
  'SMTP_PLAINTEXT_FORBIDDEN=PASS' \
  'SMTP_PASSWORD_MODE_FAIL_CLOSED=PASS' \
  'SMTP_DISABLED_FAIL_CLOSED=PASS' \
  'SMTP_STATUS_SAFE=PASS' \
  'RESULT=PASS_P26C3A_SECURITY_FOUNDATION_FIXTURE'; do
  grep -Fqx "$kv" "$EVIDENCE/security-foundation-e2e.txt" || { STOP_DETAIL="security_fixture_${kv%%=*}"; false; }
done
collect_vm121_live "$EVIDENCE/production-after-isolated.txt" || { STOP_DETAIL=production_after_isolated; false; }
assert_prod_zero "$EVIDENCE/production-after-isolated.txt" || { STOP_DETAIL=production_db_changed_by_isolated_test; false; }
[[ "$(last_field LIVE_ENV_SHA256 "$EVIDENCE/production-after-isolated.txt")" == "$PRE_ENV_SHA" ]] || { STOP_DETAIL=live_env_changed_by_isolated_test; false; }
[[ "$(last_field EXTERNAL_ONBOARDING_ACTIVE "$EVIDENCE/production-after-isolated.txt")" == false ]] || { STOP_DETAIL=external_onboarding_changed; false; }
[[ "$(last_field SMTP_DELIVERY_ACTIVE "$EVIDENCE/production-after-isolated.txt")" == false ]] || { STOP_DETAIL=smtp_delivery_changed; false; }
CORE_CHANGE_COMPLETE=true
router_step_phase_complete isolated_test durable_admin_and_strict_smtp_tls_semantics_proven_without_prod_secret_or_db_mutation

router_step_phase_begin machine_close
"$BASE/bin/router-machine-close-safe" vm121 "$STEP: SMTP TLS and durable admin secret foundation" > "$EVIDENCE/machine-close.txt" 2>&1 || { STOP_DETAIL=vm121_machine_close; false; }
grep -Fqx 'RESULT=PASS_ROUTER_MACHINE_CLOSE' "$EVIDENCE/machine-close.txt" || { STOP_DETAIL=vm121_machine_close_result; false; }
VM121_COMMIT="$(last_field COMMIT "$EVIDENCE/machine-close.txt")"
VM121_TREE="$(last_field TREE "$EVIDENCE/machine-close.txt")"
VM121_COUNT="$(last_field GIT_FILE_COUNT "$EVIDENCE/machine-close.txt")"
VM121_PUBLIC_URL="$(last_field VM121_PUBLIC_URL "$EVIDENCE/machine-close.txt")"
[[ "$VM121_COMMIT" =~ ^[0-9a-f]{40}$ ]]
[[ "$VM121_TREE" =~ ^[0-9a-f]{40}$ ]]
[[ "$VM121_COUNT" == 53 ]] || { STOP_DETAIL=vm121_new_file_count; false; }
[[ "$VM121_PUBLIC_URL" == https://reports.secret-studio.ru/latest/* ]]
router_step_phase_complete machine_close vm121_source_committed_and_published

router_step_phase_begin postcheck
ssh -T -o BatchMode=yes -o ConnectTimeout=20 vm121 /usr/local/sbin/router-vm121-git-publish.sh --check > "$EVIDENCE/post-vm121-source.txt" 2>&1
"$ROOT/scripts/source-check-validate.sh" "$EVIDENCE/post-vm121-source.txt" vm121 "$VM121_COMMIT" "$VM121_TREE" "$VM121_COUNT" > "$EVIDENCE/post-vm121-source-validation.txt" || { STOP_DETAIL=post_vm121_source; false; }
collect_vm121_live "$EVIDENCE/post-vm121-live.txt" || { STOP_DETAIL=post_vm121_live; false; }
assert_prod_zero "$EVIDENCE/post-vm121-live.txt" || { STOP_DETAIL=post_prod_state_not_zero; false; }
[[ "$(last_field LIVE_ENV_SHA256 "$EVIDENCE/post-vm121-live.txt")" == "$PRE_ENV_SHA" ]] || { STOP_DETAIL=post_live_env_changed; false; }
[[ "$(last_field EXTERNAL_ONBOARDING_ACTIVE "$EVIDENCE/post-vm121-live.txt")" == false ]] || { STOP_DETAIL=post_external_onboarding_enabled; false; }
[[ "$(last_field AUTH_ADMIN_ENV_FALLBACK "$EVIDENCE/post-vm121-live.txt")" == false ]] || { STOP_DETAIL=post_admin_env_fallback; false; }
[[ "$(last_field SMTP_DELIVERY_ACTIVE "$EVIDENCE/post-vm121-live.txt")" == false ]] || { STOP_DETAIL=post_smtp_active; false; }
cleanup_remote
router_step_phase_complete postcheck clean_source_prod_db_zero_live_env_unchanged_external_closed

router_step_phase_begin report_publish
resolve_xs_map
cat > "$REPORT/report.txt" <<EOFREPORT
RESULT=PASS_P26C3A_SMTP_TLS_AND_DURABLE_ADMIN_SECRET_FOUNDATION
REVISION=R01
CORE_CHANGE_COMPLETE=true
CORE_CHANGE_REPEATED=false
SOURCE_CHANGED=true
LIVE_DATABASE_WRITTEN=false
DATABASE_SCHEMA_CHANGED=false
ALEMBIC_VERSION=0004_profile_provisioning
VM121_ONLY_CHANGE=true
VM100_MUTATED=false
VM101_MUTATED=false
LIVE_ENV_UNCHANGED=true
EXTERNAL_ONBOARDING_ACTIVE=false
SMTP_TLS_IMPLEMENTED=true
SMTP_TLS_DELIVERY_ACTIVE=false
SMTP_SECRET_PROVISIONED=false
SMTP_STARTTLS_STRICT_VERIFICATION=PASS
SMTP_IMPLICIT_TLS_STRICT_VERIFICATION=PASS
SMTP_PLAINTEXT_FORBIDDEN=PASS
SMTP_PASSWORD_FILE_SECRET_BOUNDARY=PASS
DURABLE_ADMIN_AUTH_IMPLEMENTED=true
DURABLE_ADMIN_AUTH_ACTIVE=false
ADMIN_SECRET_PROVISIONED=false
ADMIN_SECRET_FILE_FIRST=PASS
ADMIN_ENV_FALLBACK_DISABLED_BY_DEFAULT=PASS
ADMIN_SECRET_MODE_FAIL_CLOSED=PASS
MAIL_FAILURE_ENUMERATION_RESISTANCE=PASS
UNDELIVERED_MAGIC_LINK_INVALIDATION=PASS
REAL_SMTP_DELIVERY_PROVEN=false
PUBLIC_MAGIC_LINK_URL_CONFIGURED=false
BACKEND_GENERATION_CHANGED=true
BACKUP_DIR=$BACKUP_DIR
VM100_PUBLIC_URL=$VM100_PUBLIC_URL
VM101_PUBLIC_URL=$VM101_PUBLIC_URL
VM121_COMMIT=$VM121_COMMIT
VM121_TREE=$VM121_TREE
VM121_FILE_COUNT=$VM121_COUNT
VM121_PUBLIC_URL=$VM121_PUBLIC_URL
P26_REPORT_URL=$P26_REPORT_URL
P26C1_REPORT_URL=$P26C1_REPORT_URL
P26C2_REPORT_URL=$P26C2_REPORT_URL
LOCAL_PLAN_URL=$LOCAL_PLAN_URL
GLOBAL_PLAN_URL=$GLOBAL_PLAN_URL
ACCESS_MAP_URL=$ACCESS_MAP_URL
XS_MAP_URL=$XS_MAP_URL
RUNTIME_IMPACT=true
COPY_VERIFY=PASS
NEXT_ACTION=P26C3B provision root-only admin/SMTP secrets and exact SMTP host/from/public magic-link URL, then prove real TLS mail delivery before P27
EOFREPORT
cp "$REPORT/report.txt" "$REPORT/verify.txt"
cp "$ROOT/scripts/run-step.sh" "$REPORT/executed-step.sh"
cp "$ROOT/release-info.json" "$REPORT/release-info.json"
cp "$ROOT/rollback/README.md" "$REPORT/rollback.txt"
for f in pre-vm121-source-validation.txt pre-vm121-live.txt pre-source-sha.txt backup.txt apply.txt production-gate.txt security-foundation-e2e.txt production-after-isolated.txt machine-close.txt post-vm121-source-validation.txt post-vm121-live.txt; do cp "$EVIDENCE/$f" "$REPORT/$f"; done
python3 - "$REPORT/facts.json" "$VM121_COMMIT" "$VM121_TREE" "$VM121_COUNT" "$VM121_PUBLIC_URL" "$BACKUP_DIR" <<'PYFACTS'
import json,sys
out,commit,tree,count,url,backup=sys.argv[1:]
facts={
 "schema":"wg-paid-p26c3a-r01-facts-v1",
 "result":"PASS_P26C3A_SMTP_TLS_AND_DURABLE_ADMIN_SECRET_FOUNDATION",
 "revision":"R01",
 "vm121_only_change":True,
 "source_changed":True,
 "live_database_written":False,
 "database_schema_changed":False,
 "alembic_version":"0004_profile_provisioning",
 "live_env_unchanged":True,
 "external_onboarding_active":False,
 "smtp_tls_implemented":True,
 "smtp_tls_delivery_active":False,
 "smtp_secret_provisioned":False,
 "durable_admin_auth_implemented":True,
 "durable_admin_auth_active":False,
 "admin_secret_provisioned":False,
 "real_smtp_delivery_proven":False,
 "vm121_commit":commit,"vm121_tree":tree,"vm121_file_count":int(count),"vm121_public_url":url,"backup_dir":backup,
}
with open(out,'w',encoding='utf-8') as f: json.dump(facts,f,indent=2,sort_keys=True); f.write('\n')
PYFACTS
args=()
while IFS= read -r f; do args+=("$f" "$(basename "$f")"); done < <(find "$REPORT" -maxdepth 1 -type f -print | LC_ALL=C sort)
router_step_publish_payload step050m07p26c3a_r01_smtp_tls_and_durable_admin_secret_foundation \
  "$REPORT" "$PAYLOAD" "$CURRENT" "$EVENTS" "$FINAL_ENV" "${args[@]}"
STEP_REPORT_URL="$(last_field PUBLIC_URL "$FINAL_ENV")"
router_step_phase_complete report_publish report_facts_and_exact_worker_published

router_step_phase_begin archive
archive_latest
router_step_phase_complete archive latest_archived
STOP_DETAIL=none
write_child PASS_P26C3A_SMTP_TLS_AND_DURABLE_ADMIN_SECRET_FOUNDATION 0
trap - ERR
exit 0