#!/usr/bin/env bash

# Source-only foundation for the standalone K3s LUKS header proof.

readonly K3SLRH_PROOF_RELATIVE='HyeonworksRecovery/containers/k3s-recovery.header-proof.luks'
readonly K3SLRH_PRE_KDBX_PREFIX='hyeonworks-recovery.header-proof-pre.'
readonly K3SLRH_POST_KDBX_PREFIX='hyeonworks-recovery.header-proof-post.'
readonly K3SLRH_HEADER_BACKUP_NAME='header-original.bin'
readonly K3SLRH_HEADER_EXPORT_NAME='header-exported.bin'
readonly K3SLRH_SQLITE_PACKAGE_VERSION='3.45.1-1ubuntu2.7'
readonly K3SLRH_SHARED_LIBRARY_SHA256='a206d81539e6c37fa085457ba01cff9de57de50f7235e3a4085989780e99585d'
readonly K3SLRH_A1_LIBRARY_SHA256='8b39fc46229ebd4c77ff20040f942c4ef7b756d564d344a8ecdd11a7428e2968'
readonly K3SLRH_A1_HELPER_SHA256='06831fa35943a328ecd183d3c6f721b24c4607b2f349abf6201a12e690d08ebe'
readonly K3SLRH_CONTRACT_SHA256='c045f42c2dc3eda09c37a123bcc05d88d94f275e61504a2d5816948237e516df'
readonly K3SLRH_VALIDATOR_SHA256='6b869032fc325759ee25b219fad4ea6190a3389a561c496f0664a51b802f73e6'

_k3slrh_command() {
  "$@"
}

_k3slrh_output_name_is_safe() {
  local _k3slrh_output_candidate="${1-}"
  (( $# == 1 )) || return 1
  [[ "$_k3slrh_output_candidate" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || return 1
  [[ "$_k3slrh_output_candidate" != _k3slrh_* ]]
}

_k3slrh_stderr_marker() {
  local _k3slrh_stderr_chunk='' _k3slrh_stderr_rc=0
  if IFS= read -r -d '' -n 1 _k3slrh_stderr_chunk; then
    _k3slrh_stderr_rc=0
  else
    _k3slrh_stderr_rc=$?
  fi
  if (( _k3slrh_stderr_rc == 0 )); then
    printf '\0STDERR\0'
    while IFS= read -r -d '' -n 4096 _k3slrh_stderr_chunk; do
      :
    done
  elif [[ -n "$_k3slrh_stderr_chunk" ]]; then
    printf '\0STDERR\0'
  fi
}

_k3slrh_command_packet() {
  local _k3slrh_packet_rc=0
  (( $# > 0 )) || return 1
  if _k3slrh_command "$@" 2> >(_k3slrh_stderr_marker); then
    _k3slrh_packet_rc=0
  else
    _k3slrh_packet_rc=$?
  fi
  printf '\0RC=%s\0' "$_k3slrh_packet_rc"
}

_k3slrh_capture_command() {
  local _k3slrh_capture_output="${1-}" _k3slrh_capture_expected_rc="${2-}"
  local -a _k3slrh_capture_records=()
  shift 2 || return 1
  (( $# > 0 )) || return 1
  _k3slrh_output_name_is_safe "$_k3slrh_capture_output" || return 1
  [[ "$_k3slrh_capture_expected_rc" =~ ^(0|[1-9][0-9]{0,2})$ ]] || return 1
  (( 10#$_k3slrh_capture_expected_rc <= 255 )) || return 1
  mapfile -d '' -t _k3slrh_capture_records < <(_k3slrh_command_packet "$@")
  (( ${#_k3slrh_capture_records[@]} == 2 )) || return 1
  [[ "${_k3slrh_capture_records[1]}" == "RC=${_k3slrh_capture_expected_rc}" ]] || return 1
  printf -v "$_k3slrh_capture_output" '%s' "${_k3slrh_capture_records[0]}"
}

_k3slrh_capture_one_line() {
  local _k3slrh_line_output="${1-}" _k3slrh_line_value=''
  shift || return 1
  _k3slrh_output_name_is_safe "$_k3slrh_line_output" || return 1
  _k3slrh_capture_command _k3slrh_line_value 0 "$@" || return 1
  [[ "$_k3slrh_line_value" == *$'\n' ]] || return 1
  [[ "$_k3slrh_line_value" != *$'\r'* ]] || return 1
  _k3slrh_line_value="${_k3slrh_line_value%$'\n'}"
  [[ -n "$_k3slrh_line_value" && "$_k3slrh_line_value" != *$'\n'* ]] || return 1
  printf -v "$_k3slrh_line_output" '%s' "$_k3slrh_line_value"
}

_k3slrh_parse_cli() {
  local _k3slrh_cli_output="${1-}" _k3slrh_cli_mode=''
  shift || return 1
  _k3slrh_output_name_is_safe "$_k3slrh_cli_output" || return 1
  case "$#" in
    0) _k3slrh_cli_mode=dry-run ;;
    1)
      [[ "$1" == --execute ]] || return 1
      _k3slrh_cli_mode=execute
      ;;
    *) return 1 ;;
  esac
  printf -v "$_k3slrh_cli_output" '%s' "$_k3slrh_cli_mode"
}

_k3slrh_target_state_is_consistent() {
  local _k3slrh_target_utc="${1-}" _k3slrh_target_pre="${2-}"
  local _k3slrh_target_post="${3-}" _k3slrh_target_expected_pre=''
  local _k3slrh_target_expected_post=''
  (( $# == 3 )) || return 1
  [[ "$_k3slrh_target_utc" =~ ^[0-9]{8}T[0-9]{6}Z$ ]] || return 1
  _k3slrh_target_expected_pre="HyeonworksRecovery/vault/backups/${K3SLRH_PRE_KDBX_PREFIX}${_k3slrh_target_utc}.kdbx"
  _k3slrh_target_expected_post="HyeonworksRecovery/vault/backups/${K3SLRH_POST_KDBX_PREFIX}${_k3slrh_target_utc}.kdbx"
  [[ "$_k3slrh_target_pre" == "$_k3slrh_target_expected_pre" ]] || return 1
  [[ "$_k3slrh_target_post" == "$_k3slrh_target_expected_post" ]] || return 1
  [[ "$_k3slrh_target_pre" != "$_k3slrh_target_post" ]]
}

_k3slrh_derive_targets() {
  local _k3slrh_derive_utc="${1-}" _k3slrh_derive_pre='' _k3slrh_derive_post=''
  (( $# == 1 )) || return 1
  [[ "$_k3slrh_derive_utc" =~ ^[0-9]{8}T[0-9]{6}Z$ ]] || return 1
  [[ "${K3SLRH_RUN_UTC+x}" != x && "${K3SLRH_PRE_KDBX_RELATIVE+x}" != x &&
     "${K3SLRH_POST_KDBX_RELATIVE+x}" != x ]] || return 1
  _k3slrh_derive_pre="HyeonworksRecovery/vault/backups/${K3SLRH_PRE_KDBX_PREFIX}${_k3slrh_derive_utc}.kdbx"
  _k3slrh_derive_post="HyeonworksRecovery/vault/backups/${K3SLRH_POST_KDBX_PREFIX}${_k3slrh_derive_utc}.kdbx"
  _k3slrh_target_state_is_consistent "$_k3slrh_derive_utc" "$_k3slrh_derive_pre" "$_k3slrh_derive_post" || return 1
  declare -gr K3SLRH_RUN_UTC="$_k3slrh_derive_utc"
  declare -gr K3SLRH_PRE_KDBX_RELATIVE="$_k3slrh_derive_pre"
  declare -gr K3SLRH_POST_KDBX_RELATIVE="$_k3slrh_derive_post"
}

_k3slrh_source_file_is_exact() {
  local _k3slrh_source_path="${1-}" _k3slrh_source_hash="${2-}"
  local _k3slrh_source_canonical='' _k3slrh_source_metadata='' _k3slrh_source_digest=''
  (( $# == 2 )) || return 1
  [[ "$_k3slrh_source_path" == /* && "$_k3slrh_source_hash" =~ ^[0-9a-f]{64}$ ]] || return 1
  _k3slrh_command /usr/bin/test -f "$_k3slrh_source_path" >/dev/null 2>&1 || return 1
  _k3slrh_command /usr/bin/test ! -L "$_k3slrh_source_path" >/dev/null 2>&1 || return 1
  _k3slrh_capture_one_line _k3slrh_source_canonical /usr/bin/readlink -e -- "$_k3slrh_source_path" || return 1
  [[ "$_k3slrh_source_canonical" == "$_k3slrh_source_path" ]] || return 1
  _k3slrh_capture_one_line _k3slrh_source_metadata /usr/bin/stat '--format=%F|%u|%g|%a' -- "$_k3slrh_source_path" || return 1
  [[ "$_k3slrh_source_metadata" == 'regular file|'* || "$_k3slrh_source_metadata" == 'regular empty file|'* ]] || return 1
  _k3slrh_capture_one_line _k3slrh_source_digest /usr/bin/sha256sum -- "$_k3slrh_source_path" || return 1
  [[ "$_k3slrh_source_digest" == "${_k3slrh_source_hash}  ${_k3slrh_source_path}" ]]
}

_k3slrh_required_sources_are_exact() {
  local _k3slrh_source_root="${K3SLRH_REPOSITORY_ROOT:-}"
  (( $# == 0 )) || return 1
  [[ "$_k3slrh_source_root" == /* ]] || return 1
  _k3slrh_source_file_is_exact "${_k3slrh_source_root}/scripts/lib/k3s-local-recovery.sh" "$K3SLRH_SHARED_LIBRARY_SHA256" || return 1
  _k3slrh_source_file_is_exact "${_k3slrh_source_root}/scripts/lib/k3s-local-recovery-a1.sh" "$K3SLRH_A1_LIBRARY_SHA256" || return 1
  _k3slrh_source_file_is_exact "${_k3slrh_source_root}/scripts/libexec/k3s-local-recovery-a1-check.sh" "$K3SLRH_A1_HELPER_SHA256" || return 1
  _k3slrh_source_file_is_exact "${_k3slrh_source_root}/infrastructure/security/k3s/local-recovery.env" "$K3SLRH_CONTRACT_SHA256"
}

_k3slrh_required_binaries_are_trusted() {
  local _k3slrh_binary=''
  local -a _k3slrh_binaries=(
    /usr/bin/bash
    /usr/bin/date
    /usr/bin/dpkg-query
    /usr/bin/env
    /usr/bin/find
    /usr/bin/findmnt
    /usr/bin/keepassxc-cli
    /usr/bin/readlink
    /usr/bin/sha256sum
    /usr/bin/sqlite3
    /usr/bin/stat
    /usr/bin/sudo
    /usr/bin/systemctl
    /usr/bin/test
    /usr/bin/timeout
    /usr/local/bin/k3s
    /usr/sbin/cryptsetup
    /usr/sbin/losetup
  )
  (( $# == 0 )) || return 1
  for _k3slrh_binary in "${_k3slrh_binaries[@]}"; do
    _k3slr_trusted_root_executable "$_k3slrh_binary" || return 1
  done
}

_k3slrh_package_is_exact() {
  local _k3slrh_package_name="${1-}" _k3slrh_package_expected="${2-}"
  local _k3slrh_package_record=''
  (( $# == 2 )) || return 1
  case "$_k3slrh_package_name|$_k3slrh_package_expected" in
    'keepassxc|2.7.6+dfsg.1-1build3'|'cryptsetup-bin|2:2.7.0-1ubuntu4.2'|"sqlite3|${K3SLRH_SQLITE_PACKAGE_VERSION}") ;;
    *) return 1 ;;
  esac
  _k3slrh_capture_command _k3slrh_package_record 0 /usr/bin/dpkg-query --show '--showformat=${Status}|${Version}\n' "$_k3slrh_package_name" || return 1
  [[ "$_k3slrh_package_record" == "install ok installed|${_k3slrh_package_expected}"$'\n' ]]
}

_k3slrh_packages_are_exact() {
  (( $# == 0 )) || return 1
  _k3slrh_package_is_exact keepassxc '2.7.6+dfsg.1-1build3' || return 1
  _k3slrh_package_is_exact cryptsetup-bin '2:2.7.0-1ubuntu4.2' || return 1
  _k3slrh_package_is_exact sqlite3 "$K3SLRH_SQLITE_PACKAGE_VERSION"
}

_k3slrh_cached_sudo_is_available() {
  (( $# == 0 )) || return 1
  _k3slrh_command /usr/bin/sudo --non-interactive --validate >/dev/null 2>&1
}

_k3slrh_k3s_health() {
  local _k3slrh_health_systemctl='' _k3slrh_health_readyz=''
  (( $# == 0 )) || return 1
  _k3slrh_capture_command _k3slrh_health_systemctl 0 /usr/bin/systemctl is-active --quiet k3s || return 1
  [[ -z "$_k3slrh_health_systemctl" ]] || return 1
  _k3slrh_capture_command _k3slrh_health_readyz 0 \
    /usr/bin/sudo --non-interactive -- \
    /usr/bin/env -i 'PATH=/usr/sbin:/usr/bin:/sbin:/bin' LC_ALL=C \
    /usr/bin/timeout --signal=TERM --kill-after=1s 30s \
    /usr/local/bin/k3s kubectl get --raw=/readyz || return 1
  [[ "$_k3slrh_health_readyz" == $'ok\n' ]]
}

_k3slrh_run_closed_validator() {
  local _k3slrh_validator_path='' _k3slrh_validator_record=''
  local _k3slrh_validator_command_rc=0 _k3slrh_validator_post_rc=0
  (( $# == 0 )) || return 1
  [[ "${K3SLRH_REPOSITORY_ROOT:-}" == /* ]] || return 1
  _k3slrh_validator_path="${K3SLRH_REPOSITORY_ROOT}/scripts/validate/k3s-local-recovery.sh"
  _k3slrh_source_file_is_exact "$_k3slrh_validator_path" "$K3SLRH_VALIDATOR_SHA256" || return 1
  _k3slrh_capture_command _k3slrh_validator_record 0 \
    /usr/bin/env -i 'PATH=/usr/sbin:/usr/bin:/sbin:/bin' LC_ALL=C \
    /usr/bin/bash --noprofile --norc -- "$_k3slrh_validator_path" --expect-closed ||
      _k3slrh_validator_command_rc=1
  _k3slrh_source_file_is_exact "$_k3slrh_validator_path" "$K3SLRH_VALIDATOR_SHA256" ||
    _k3slrh_validator_post_rc=1
  (( _k3slrh_validator_command_rc == 0 && _k3slrh_validator_post_rc == 0 )) || return 1
  [[ "$_k3slrh_validator_record" == $'Recovery device: match\nRecovery state: closed\nLineage: match\nLatest bundle: not_checked\n' ]]
}

_k3slrh_mount_is_absent() {
  local _k3slrh_mount_path="${1-}" _k3slrh_mount_record=''
  (( $# == 1 )) || return 1
  [[ "$_k3slrh_mount_path" == /* ]] || return 1
  _k3slrh_capture_command _k3slrh_mount_record 1 /usr/bin/findmnt -rn -M "$_k3slrh_mount_path" -o TARGET || return 1
  [[ -z "$_k3slrh_mount_record" ]]
}

_k3slrh_mapping_is_absent() {
  local _k3slrh_mapping_path="${1-}"
  (( $# == 1 )) || return 1
  case "$_k3slrh_mapping_path" in
    "/dev/mapper/${K3SLR_MAPPING_NAME}"|"/dev/mapper/${K3SLR_PROOF_MAPPING_NAME}") ;;
    *) return 1 ;;
  esac
  _k3slrh_command /usr/bin/test ! -e "$_k3slrh_mapping_path" >/dev/null 2>&1 || return 1
  _k3slrh_command /usr/bin/test ! -L "$_k3slrh_mapping_path" >/dev/null 2>&1
}

_k3slrh_related_loops_are_absent() {
  local _k3slrh_loop_record='' _k3slrh_loop_line=''
  local _k3slrh_loop_original="${K3SLR_OUTER_MOUNT}/${K3SLR_CONTAINER_RELATIVE}"
  local _k3slrh_loop_proof="${K3SLR_OUTER_MOUNT}/${K3SLRH_PROOF_RELATIVE}"
  (( $# == 0 )) || return 1
  _k3slrh_capture_command _k3slrh_loop_record 0 /usr/sbin/losetup --list --noheadings --output NAME,BACK-FILE || return 1
  while IFS= read -r _k3slrh_loop_line; do
    [[ -n "$_k3slrh_loop_line" ]] || continue
    case "$_k3slrh_loop_line" in
      *" ${_k3slrh_loop_original}"|*" ${_k3slrh_loop_proof}") return 1 ;;
    esac
  done <<<"$_k3slrh_loop_record"
}

_k3slrh_outer_mountpoint_is_clean() {
  local _k3slrh_outer_canonical='' _k3slrh_outer_metadata='' _k3slrh_outer_children=''
  (( $# == 0 )) || return 1
  _k3slrh_command /usr/bin/test -d "$K3SLR_OUTER_MOUNT" >/dev/null 2>&1 || return 1
  _k3slrh_command /usr/bin/test ! -L "$K3SLR_OUTER_MOUNT" >/dev/null 2>&1 || return 1
  _k3slrh_capture_one_line _k3slrh_outer_canonical /usr/bin/readlink -e -- "$K3SLR_OUTER_MOUNT" || return 1
  [[ "$_k3slrh_outer_canonical" == "$K3SLR_OUTER_MOUNT" ]] || return 1
  _k3slrh_capture_one_line _k3slrh_outer_metadata /usr/bin/stat '--format=%F|%u|%g|%a' -- "$K3SLR_OUTER_MOUNT" || return 1
  [[ "$_k3slrh_outer_metadata" == 'directory|0|0|755' ]] || return 1
  _k3slrh_capture_command _k3slrh_outer_children 0 /usr/bin/find "$K3SLR_OUTER_MOUNT" -mindepth 1 -maxdepth 1 -print -quit || return 1
  [[ -z "$_k3slrh_outer_children" ]]
}

_k3slrh_runtime_residue_is_absent() {
  local _k3slrh_runtime_record=''
  (( $# == 0 )) || return 1
  _k3slrh_capture_command _k3slrh_runtime_record 0 /usr/bin/find /run -mindepth 1 -maxdepth 1 -name 'hyeonworks-k3s-recovery.*' -print -quit || return 1
  [[ -z "$_k3slrh_runtime_record" ]]
}

_k3slrh_closed_resources_are_absent() {
  (( $# == 0 )) || return 1
  _k3slrh_mount_is_absent "$K3SLR_OUTER_MOUNT" || return 1
  _k3slrh_mount_is_absent "$K3SLR_INNER_MOUNT" || return 1
  _k3slrh_mapping_is_absent "/dev/mapper/${K3SLR_MAPPING_NAME}" || return 1
  _k3slrh_mapping_is_absent "/dev/mapper/${K3SLR_PROOF_MAPPING_NAME}" || return 1
  _k3slrh_related_loops_are_absent || return 1
  _k3slrh_outer_mountpoint_is_clean || return 1
  _k3slrh_runtime_residue_is_absent
}

_k3slrh_pre_mount_checks() {
  (( $# == 0 )) || return 1
  _k3slrh_required_sources_are_exact || return 1
  _k3slrh_required_binaries_are_trusted || return 1
  _k3slrh_packages_are_exact || return 1
  _k3slrh_cached_sudo_is_available || return 1
  _k3slrh_k3s_health || return 1
  _k3slrh_run_closed_validator || return 1
  _k3slrh_closed_resources_are_absent
}

_k3slrh_pre_mount_capability() {
  (( $# == 0 )) || return 1
  _k3slrh_pre_mount_checks || return 1
  printf 'Header proof capability: pass\n'
}

_k3slrh_current_utc() {
  local _k3slrh_utc_output="${1-}" _k3slrh_utc_value=''
  (( $# == 1 )) || return 1
  _k3slrh_output_name_is_safe "$_k3slrh_utc_output" || return 1
  _k3slrh_capture_one_line _k3slrh_utc_value /usr/bin/date --utc +%Y%m%dT%H%M%SZ || return 1
  [[ "$_k3slrh_utc_value" =~ ^[0-9]{8}T[0-9]{6}Z$ ]] || return 1
  printf -v "$_k3slrh_utc_output" '%s' "$_k3slrh_utc_value"
}

_k3slrh_header_proof_main() {
  local _k3slrh_main_mode='' _k3slrh_main_utc='' _k3slrh_main_parse_rc=0
  if _k3slrh_parse_cli _k3slrh_main_mode "$@"; then
    _k3slrh_main_parse_rc=0
  else
    _k3slrh_main_parse_rc=$?
  fi
  (( _k3slrh_main_parse_rc == 0 )) || return 2
  [[ "${EUID:-}" =~ ^[0-9]+$ && "${EUID:-}" != 0 ]] || return 1
  _k3slr_xtrace_is_disabled || return 1
  if [[ "$_k3slrh_main_mode" == execute ]]; then
    _k3slr_require_execute_tty || return 1
    declare -F _k3slrh_prove_header_restore_a1 >/dev/null || return 1
    return 1
  fi
  _k3slrh_current_utc _k3slrh_main_utc || return 1
  _k3slrh_derive_targets "$_k3slrh_main_utc" || return 1
  _k3slrh_pre_mount_checks || return 1
  printf '%s\n' \
    'Header proof state: closed' \
    'Header proof capability: pass' \
    'Execute-time checks: pending' \
    'DRY RUN PASS: no changes'
}