#!/usr/bin/env bash
set -Eeuo pipefail

STEP_ID="${STEP_ID:-PRECHECK_PUBLICATION_LEGACY_AND_REINDEX_R05A2}"
BASE="/opt/router-ops"
if [[ -z "${STEP_DIR:-}" ]]; then
  TS="$(date +%Y%m%d-%H%M%S)"
  STEP_DIR="$BASE/steps/${TS}_${STEP_ID}"
fi
REPORT="$STEP_DIR/report.txt"
FACTS="$STEP_DIR/facts.json"
VERIFY="$STEP_DIR/verify.txt"
LOG="$STEP_DIR/main.log"
ROLLBACK="$STEP_DIR/rollback.txt"
FINDINGS="$STEP_DIR/findings.txt"
SOURCES="$STEP_DIR/active-source-sha256.txt"
INDEX_AUDIT="$STEP_DIR/index-audit.txt"
PUBLISH_OUT="$STEP_DIR/publisher-output.txt"
SAFE_DIR="/tmp/router-r05a2-${TS}"

PUBLISHER="$BASE/bin/router-publish-report"
REINDEX="$BASE/bin/router-public-reindex"
TOKEN_FILE="$BASE/public/.router-public-token"
DOMAIN="reports.secret-studio.ru"
EXPECTED_PUBLISHER_SHA256="e78430b57afbd0ae27fc575fc4de78bb267c76caf04ec935b01e9b2f89840e32"
LOCAL_M07_PLAN_URL="https://$DOMAIN/latest/20260713-193942_local_architecture_plan_vm101_autonomous_hmn_recovery/"
GLOBAL_PROJECT_PLAN_URL="https://$DOMAIN/latest/20260711-123348_global_project_plan_wg_paid/"
ACCESS_MAP_URL="https://$DOMAIN/latest/20260714-092500_access_map_canonical_current/"
VM100_PUBLIC_URL="https://$DOMAIN/latest/20260713-182653_vm100_git_source_097755408853/"
VM101_PUBLIC_URL="https://$DOMAIN/latest/20260713-192042_vm101_git_source_027589515a26/"
VM121_PUBLIC_URL="https://$DOMAIN/latest/20260713-182700_vm121_git_source_93e0e5a31f09/"
VM101_MODEL_URL="https://$DOMAIN/latest/20260713-192030_vm101_model_hmn_download_selector_r13a/"
VM101_METHODS_URL="https://$DOMAIN/latest/20260713-193942_vm101_methods_machine_git_count_contract_r13b/"
VM130_SOURCE_URL="https://$DOMAIN/latest/20260714-085433_vm130_router_ops_source_snapshot_r13f/"

mkdir -p "$STEP_DIR" "$SAFE_DIR"
chmod 700 "$STEP_DIR" "$SAFE_DIR"
exec > >(tee -a "$LOG") 2>&1

p(){ printf '>>> [%s] %s\n' "$(date '+%F %T')" "$*"; }
stop(){
  printf 'RESULT=%s\nSTOP_REASON=%s\nSTEP_REPORT_URL=PENDING_NOT_PUBLISHED\nCOPY_VERIFY=PASS\nSTEP_SHA256=%s\nSTEP_WAS_NOT_STARTED=false\nRUNTIME_IMPACT=false\n' "$1" "$2" "${STEP_SHA256:-UNKNOWN}"
  exit 20
}

p "preflight"
for c in sha256sum grep find awk sed sort python3 curl; do command -v "$c" >/dev/null || stop STOP_AUDIT_PREFLIGHT "missing_$c"; done
[[ -x "$PUBLISHER" ]] || stop STOP_AUDIT_PREFLIGHT publisher_missing
[[ -x "$REINDEX" ]] || stop STOP_AUDIT_PREFLIGHT reindex_missing
[[ -s "$TOKEN_FILE" ]] || stop STOP_AUDIT_PREFLIGHT token_missing

LIVE_SHA="$(sha256sum "$PUBLISHER"|awk '{print $1}')"
[[ "$LIVE_SHA" == "$EXPECTED_PUBLISHER_SHA256" ]] || stop STOP_LIVE_PUBLISHER_CHANGED "$LIVE_SHA"

TOKEN="$(cat "$TOKEN_FILE")"
ROOT="$BASE/public/r/$TOKEN"
LATEST="$ROOT/latest"
OLD="$ROOT/old"
INDEX="$LATEST/index.html"
[[ -d "$LATEST" && -d "$OLD" && -f "$INDEX" ]] || stop STOP_AUDIT_PREFLIGHT latest_old_or_index_missing

p "auditing active generators"
FILES=(
"$BASE/bin/router-publish-report"
"$BASE/bin/router-public-url"
"$BASE/bin/router-public-reindex"
"$BASE/bin/router-vm100-git-source-publish"
"$BASE/bin/router-vm101-git-source-publish"
"$BASE/bin/router-vm121-git-source-publish"
"$BASE/bin/router-machine-close"
)
: > "$FINDINGS"
: > "$SOURCES"
for f in "${FILES[@]}"; do
  if [[ -f "$f" ]]; then
    printf '%s  %s\n' "$(sha256sum "$f"|awk '{print $1}')" "$f" >> "$SOURCES"
    safe_name="source-$(basename "$f").txt"
    cp -a "$f" "$SAFE_DIR/$safe_name"
    chmod 644 "$SAFE_DIR/$safe_name"
    grep -nEi 'trycloudflare|cloudflared|TRYCF_|QUICK_TUNNEL|reports\.secret-studio\.ru|LATEST_ROOT_URL|STEP_REPORT_URL' "$f" 2>/dev/null | sed "s#^#$f:#" >> "$FINDINGS" || true
  else
    printf 'MISSING  %s\n' "$f" >> "$SOURCES"
  fi
done
find "$BASE/state" -maxdepth 2 -type f \( -name '*.env' -o -name '*.txt' \) -print0 2>/dev/null |
  xargs -0 grep -nHEi 'trycloudflare|cloudflared|TRYCF_|QUICK_TUNNEL|reports\.secret-studio\.ru' 2>/dev/null >> "$FINDINGS" || true

LEGACY_HITS="$(grep -Eic 'trycloudflare|cloudflared|TRYCF_|QUICK_TUNNEL' "$FINDINGS" || true)"
PERMANENT_HITS="$(grep -Eic 'reports\.secret-studio\.ru|LATEST_ROOT_URL|STEP_REPORT_URL' "$FINDINGS" || true)"

p "auditing latest index freshness"
NEWEST_STEP="$(find "$LATEST" -mindepth 1 -maxdepth 1 -type d -name '*_step*' -printf '%f\n'|sort|tail -n1)"
INDEX_STEP="$(grep -Eo '[0-9]{8}-[0-9]{6}_[^"/ ]*step[^"/ ]*' "$INDEX"|sort|tail -n1 || true)"
LATEST_STEP_COUNT="$(find "$LATEST" -mindepth 1 -maxdepth 1 -type d -name '*_step*'|wc -l|tr -d ' ')"
INDEX_FRESH=false
[[ -n "$NEWEST_STEP" && "$INDEX_STEP" == "$NEWEST_STEP" ]] && INDEX_FRESH=true

ROOT_CODE="$(curl -sS --connect-timeout 5 --max-time 15 --resolve "$DOMAIN:443:10.71.100.84" -o /dev/null -w '%{http_code}' "https://$DOMAIN/" 2>/dev/null || true)"
LATEST_CODE="$(curl -sS --connect-timeout 5 --max-time 15 --resolve "$DOMAIN:443:10.71.100.84" -o /dev/null -w '%{http_code}' "https://$DOMAIN/latest/" 2>/dev/null || true)"
OLD_CODE="$(curl -sS --connect-timeout 5 --max-time 15 --resolve "$DOMAIN:443:10.71.100.84" -o /dev/null -w '%{http_code}' "https://$DOMAIN/old/" 2>/dev/null || true)"

cat > "$INDEX_AUDIT" <<EOF
NEWEST_STEP_FOLDER=$NEWEST_STEP
INDEX_STEP_FOLDER=$INDEX_STEP
LATEST_STEP_COUNT=$LATEST_STEP_COUNT
INDEX_FRESH=$INDEX_FRESH
ROOT_CODE=${ROOT_CODE:-000}
LATEST_CODE=${LATEST_CODE:-000}
OLD_CODE=${OLD_CODE:-000}
EOF

RESULT=PASS_PUBLICATION_AUDIT_WITH_FINDINGS
cat > "$REPORT" <<EOF
RESULT=$RESULT
STEP_ID=$STEP_ID
LOCAL_M07_PLAN_URL=$LOCAL_M07_PLAN_URL
GLOBAL_PROJECT_PLAN_URL=$GLOBAL_PROJECT_PLAN_URL
ACCESS_MAP_URL=$ACCESS_MAP_URL
VM100_PUBLIC_URL=$VM100_PUBLIC_URL
VM101_PUBLIC_URL=$VM101_PUBLIC_URL
VM121_PUBLIC_URL=$VM121_PUBLIC_URL
VM101_MODEL_URL=$VM101_MODEL_URL
VM101_METHODS_URL=$VM101_METHODS_URL
VM130_SOURCE_URL=$VM130_SOURCE_URL
SYSTEM_CHANGE=false
RUNTIME_IMPACT=false
LIVE_PUBLISHER_SHA256=$LIVE_SHA
LEGACY_REFERENCE_HITS=$LEGACY_HITS
PERMANENT_REFERENCE_HITS=$PERMANENT_HITS
INDEX_FRESH=$INDEX_FRESH
NEWEST_STEP_FOLDER=$NEWEST_STEP
INDEX_STEP_FOLDER=$INDEX_STEP
LATEST_STEP_COUNT=$LATEST_STEP_COUNT
ROOT_CODE=${ROOT_CODE:-000}
LATEST_CODE=${LATEST_CODE:-000}
OLD_CODE=${OLD_CODE:-000}
FINDINGS=$FINDINGS
INDEX_AUDIT=$INDEX_AUDIT
ROLLBACK_REQUIRED=false
EOF
cp "$REPORT" "$VERIFY"
cat > "$ROLLBACK" <<EOF
ROLLBACK_REQUIRED=false
REASON=Read-only audit; no source, service, index or public object was changed except this audit publication.
EOF
python3 - "$FACTS" <<PY
import json
from pathlib import Path
Path("$FACTS").write_text(json.dumps({
 "step_id":"$STEP_ID","result":"$RESULT","system_change":False,"runtime_impact":False,
 "live_publisher_sha256":"$LIVE_SHA","legacy_reference_hits":int("$LEGACY_HITS"),
 "permanent_reference_hits":int("$PERMANENT_HITS"),"index_fresh":"$INDEX_FRESH"=="true",
 "newest_step_folder":"$NEWEST_STEP","index_step_folder":"$INDEX_STEP",
 "latest_step_count":int("$LATEST_STEP_COUNT"),
 "http":{"root":"${ROOT_CODE:-000}","latest":"${LATEST_CODE:-000}","old":"${OLD_CODE:-000}"}
},indent=2)+"\n",encoding="utf-8")
PY

p "publishing audit"
for f in "$REPORT" "$FACTS" "$VERIFY" "$ROLLBACK" "$FINDINGS" "$SOURCES" "$INDEX_AUDIT" "$LOG"; do
  cp -a "$f" "$SAFE_DIR/$(basename "$f")"
  chmod 644 "$SAFE_DIR/$(basename "$f")"
done
cp -a "$STEP_DIR/step-code.sh" "$SAFE_DIR/step-code.sh"
cp -a "$STEP_DIR/transfer-verify.txt" "$SAFE_DIR/transfer-verify.txt"
chmod 644 "$SAFE_DIR/"*

mapfile -t PUB_FILES < <(find "$SAFE_DIR" -maxdepth 1 -type f -printf '%p\n'|sort)
"$PUBLISHER" "step_publication_legacy_reindex_audit_r05a2" "${PUB_FILES[@]}" > "$PUBLISH_OUT"

STEP_REPORT_URL="$(awk -F= '$1=="STEP_REPORT_URL"{print substr($0,index($0,"=")+1)}' "$PUBLISH_OUT"|tail -n1)"
[[ "$STEP_REPORT_URL" == "https://$DOMAIN/latest/"*"/" ]] || stop STOP_AUDIT_PUBLICATION permanent_url_missing

p "audit published"
printf 'RESULT=%s\nSTEP_REPORT_URL=%s\nCOPY_VERIFY=PASS\nSTEP_SHA256=%s\nRUNTIME_IMPACT=false\n' "$RESULT" "$STEP_REPORT_URL" "${STEP_SHA256:-UNKNOWN}"