#!/bin/sh
set -u
umask 077

CONF="/etc/router-egress-emergency-refresh.conf"
RUNNER="/usr/local/sbin/router-egress-emergency-refresh.sh"
PLANNER="/usr/local/sbin/router-egress-hmn-plan-top5.sh"
CODE_TEST="/root/hmn/hmn-code-test.sh"

HOOK_INIT="/etc/init.d/router-egress-emergency-decision"
WATCHER_INIT="/etc/init.d/router-egress-health-repair"

fact() {
  printf '__FACT__ %s=%s\n' "$1" "$2"
}

json_block() {
  echo "__JSON_BEGIN__ $1"
  printf '%s\n' "$2"
  echo "__JSON_END__ $1"
}

bool_cmd() {
  if "$@" >/dev/null 2>&1; then
    printf true
  else
    printf false
  fi
}

for required in \
  "$CONF" \
  "$RUNNER" \
  "$PLANNER" \
  "$CODE_TEST"
do
  [ -e "$required" ] || {
    echo "__ERROR__ missing=$required"
    exit 21
  }
done

RAW="$(
  (
    . "$CONF"
    printf '%s' "${EMERGENCY_COMMIT_ENABLED:-UNSET}"
  )
)"

fact commit_raw "$RAW"
fact hook_running "$(bool_cmd "$HOOK_INIT" running)"
fact hook_enabled "$(bool_cmd "$HOOK_INIT" enabled)"
fact watcher_running "$(bool_cmd "$WATCHER_INIT" running)"
fact watcher_enabled "$(bool_cmd "$WATCHER_INIT" enabled)"

fact emergency_lock_present "$(
  bool_cmd test -e /var/lock/router-egress-emergency-refresh.lock
)"

fact refresh_lock_present "$(
  bool_cmd test -e /tmp/hmn-refresh-pool-safe.lock
)"

STRICT_ALL=true

for interface in vpn1 vpn2 vpn3 vpn4 vpn5; do
  if ping -I "$interface" -c 1 -W 3 1.1.1.1 >/dev/null 2>&1; then
    value=true
  else
    value=false
    STRICT_ALL=false
  fi

  fact "strict.${interface}" "$value"
done

fact strict_all "$STRICT_ALL"

ROUTES_ALL=true

for table in 201 202 203 204 205; do
  if ip route show table "$table" 2>/dev/null |
    grep -q '^default '
  then
    value=true
  else
    value=false
    ROUTES_ALL=false
  fi

  fact "route.${table}" "$value"
done

fact routes_all "$ROUTES_ALL"

RUNNER_JSON="$("$RUNNER" --dry-run)"
PLANNER_JSON="$("$PLANNER")"

json_block runner "$RUNNER_JSON"
json_block planner "$PLANNER_JSON"

CODE_RAW="/tmp/step050m07c2-code-test.$$.raw"

set +e
"$CODE_TEST" > "$CODE_RAW" 2>&1
CODE_RC=$?
set -e

fact code_test_rc "$CODE_RC"
fact code_test_size "$(
  wc -c < "$CODE_RAW" |
    tr -d ' '
)"

CODE_SUMMARY="$(
  grep -Ei \
    'pass|success|valid|invalid|fail|error|http|serverlist|download' \
    "$CODE_RAW" |
    tail -n 50 ||
  true
)"

rm -f "$CODE_RAW"

echo "__BLOCK_BEGIN__ code_test_sanitized_summary"
printf '%s\n' "$CODE_SUMMARY" |
  sed \
    -e 's/[Cc][Oo][Dd][Ee]=[^ ]*/code=REDACTED/g' \
    -e 's/[Tt][Oo][Kk][Ee][Nn]=[^ ]*/token=REDACTED/g' \
    -e 's/[Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd]=[^ ]*/password=REDACTED/g'
echo "__BLOCK_END__ code_test_sanitized_summary"

fact production_modified false

[ "$RAW" = "1" ]
[ "$CODE_RC" -eq 0 ]
[ "$STRICT_ALL" = true ]
[ "$ROUTES_ALL" = true ]