#!/usr/bin/env bash
set -Eeuo pipefail
umask 022

START_DIR="$PWD"
STAMP="$(date '+%Y%m%d_%H%M%S')"
BASE="STEP011_2156_DISTRIBUITE_LOCAL_VHOST_VS_NPM_HTTPS_AUDIT_ONLY_${STAMP}"
WORKDIR="${START_DIR}/.${BASE}_work_$$"
OUTZIP="${START_DIR}/${BASE}.zip"
LOGFILE="${WORKDIR}/run.log"
REPORT="${WORKDIR}/report.txt"
PACKAGED=0
FAILURES=0
WARNINGS=0

EXPECTED_HOST="${STEP_EXPECTED_HOST:-ax-accessi}"
EXPECTED_IP="${STEP_EXPECTED_IP:-192.168.215.6}"
SKIP_SERVER_CHECK="${STEP_SKIP_SERVER_CHECK:-0}"
DOMAIN="${STEP_DOMAIN:-presenze.distribuite.axuno.it}"
LOCAL_URL="${STEP_LOCAL_URL:-http://${DOMAIN}/}"
PUBLIC_URL="${STEP_PUBLIC_URL:-https://${DOMAIN}/}"
EXPECTED_NPM_IP="${STEP_EXPECTED_NPM_IP:-195.231.28.29}"

mkdir -p "$WORKDIR"
: >"$LOGFILE"
: >"$REPORT"

log(){ printf '%s\n' "$*" | tee -a "$LOGFILE"; }
report(){ printf '%s\n' "$*" >>"$REPORT"; }
fail(){ FAILURES=$((FAILURES+1)); log "ERRORE: $*"; report "ERRORE: $*"; }
warn(){ WARNINGS=$((WARNINGS+1)); log "ATTENZIONE: $*"; report "ATTENZIONE: $*"; }

package_results(){
    local rc="${1:-0}" zip_rc=0
    [[ "$PACKAGED" -eq 1 ]] && return 0
    PACKAGED=1
    report ""
    report "Esito finale: errori=${FAILURES}, avvisi=${WARNINGS}, exit_code=${rc}"
    rm -f -- "$OUTZIP"
    command -v zip >/dev/null 2>&1 || { rm -rf -- "$WORKDIR"; return 127; }
    (cd "$WORKDIR" && zip -qr "$OUTZIP" .) || zip_rc=$?
    [[ "$zip_rc" -eq 0 ]] && zip -T "$OUTZIP" >>"$LOGFILE" 2>&1 || true
    rm -rf -- "$WORKDIR"
    [[ "$zip_rc" -eq 0 ]] || { rm -f -- "$OUTZIP"; return "$zip_rc"; }
    printf '%s\n' "ZIP CREATO E VERIFICATO: $OUTZIP"
}
on_exit(){ local rc=$?; trap - EXIT INT TERM HUP; package_results "$rc" || rc=$?; exit "$rc"; }
trap on_exit EXIT
trap 'exit 130' INT
trap 'exit 143' TERM HUP

log "$BASE"
log "SERVER ATTESO: 215.6 / ax-accessi"
log "MODALITA': AUDIT ONLY - NESSUNA MODIFICA"
log "Avvio: $(date --iso-8601=seconds)"

ACTUAL_HOST="$(hostname -s 2>/dev/null || hostname)"
ACTUAL_IPS="$(hostname -I 2>/dev/null | xargs || true)"

{
  echo "STEP: $BASE"
  echo "Hostname: $ACTUAL_HOST"
  echo "IP: $ACTUAL_IPS"
  echo "Dominio: $DOMAIN"
  echo "NPM atteso: $EXPECTED_NPM_IP"
} >>"$REPORT"

if [[ "$SKIP_SERVER_CHECK" != "1" ]]; then
    [[ "$ACTUAL_HOST" == "$EXPECTED_HOST" ]] || fail "hostname ${ACTUAL_HOST}; previsto ${EXPECTED_HOST}"
    [[ -z "$EXPECTED_IP" ]] || grep -qw -- "$EXPECTED_IP" <<<"$ACTUAL_IPS" || fail "IP previsto ${EXPECTED_IP} non presente"
fi
[[ "$FAILURES" -eq 0 ]] || exit 20

CURL_BIN="${STEP_CURL_BIN:-$(command -v curl || true)}"
APACHE2CTL_BIN="${STEP_APACHE2CTL_BIN:-$(command -v apache2ctl || true)}"
[[ -n "$CURL_BIN" ]] || { fail "curl non disponibile"; exit 21; }
[[ -n "$APACHE2CTL_BIN" ]] || { fail "apache2ctl non disponibile"; exit 22; }

log "[1/5] Configurazione Apache"
"$APACHE2CTL_BIN" -t >"${WORKDIR}/01_APACHE_CONFIGTEST.txt" 2>&1 || fail "apache2ctl -t fallito"
"$APACHE2CTL_BIN" -S >"${WORKDIR}/02_APACHE_VHOSTS.txt" 2>&1 || warn "apache2ctl -S ha restituito errore"
grep -Fq "$DOMAIN" "${WORKDIR}/02_APACHE_VHOSTS.txt" || fail "vhost ${DOMAIN} non trovato"
[[ "$FAILURES" -eq 0 ]] || exit 23

log "[2/5] Vhost locale HTTP"
LOCAL_HEADERS="${WORKDIR}/03_LOCAL_HTTP_HEADERS.txt"
LOCAL_BODY="${WORKDIR}/04_LOCAL_HTTP_BODY.html"
LOCAL_CODE="$("$CURL_BIN" --resolve "${DOMAIN}:80:127.0.0.1" --connect-timeout 5 --max-time 15 -D "$LOCAL_HEADERS" -o "$LOCAL_BODY" -sS -w '%{http_code}' "$LOCAL_URL" 2>>"$LOGFILE" || true)"
LOCAL_SIZE="$(wc -c <"$LOCAL_BODY" 2>/dev/null | tr -d ' ' || printf '0')"
LOCAL_LOCATION="$(awk 'BEGIN{IGNORECASE=1} /^Location:/ {$1=""; sub(/^[[:space:]]+/,""); sub(/\r$/,""); print; exit}' "$LOCAL_HEADERS" 2>/dev/null || true)"
{
  printf 'voce\tvalore\n'
  printf 'local_http_code\t%s\n' "$LOCAL_CODE"
  printf 'local_body_bytes\t%s\n' "$LOCAL_SIZE"
  printf 'local_location\t%s\n' "$LOCAL_LOCATION"
} >"${WORKDIR}/05_LOCAL_HTTP_RESULT.tsv"

case "$LOCAL_CODE" in
  200|204|301|302|303|307|308) report "Vhost locale HTTP raggiungibile: $LOCAL_CODE" ;;
  *) fail "vhost locale HTTP non raggiungibile: $LOCAL_CODE" ;;
esac
[[ "$LOCAL_CODE" != "200" || "$LOCAL_SIZE" -gt 100 ]] || fail "risposta locale HTTP 200 troppo piccola"
if [[ -s "$LOCAL_BODY" ]] && grep -Eiq 'Fatal error|Parse error|Uncaught exception|SQLSTATE|Access denied for user' "$LOCAL_BODY"; then
  fail "risposta locale con errore PHP/SQL"
fi
[[ "$FAILURES" -eq 0 ]] || exit 24

log "[3/5] DNS pubblico"
DNS_FILE="${WORKDIR}/06_DNS_A_RECORDS.txt"
: >"$DNS_FILE"
if command -v getent >/dev/null 2>&1; then
  getent ahostsv4 "$DOMAIN" 2>>"$LOGFILE" | awk '{print $1}' | sort -u >"$DNS_FILE" || true
elif command -v host >/dev/null 2>&1; then
  host -t A "$DOMAIN" 2>>"$LOGFILE" | awk '/has address/ {print $4}' | sort -u >"$DNS_FILE" || true
else
  warn "getent/host non disponibili"
fi
DNS_COUNT="$(grep -cve '^[[:space:]]*$' "$DNS_FILE" || true)"
DNS_EXPECTED_MATCH="$(grep -cFx "$EXPECTED_NPM_IP" "$DNS_FILE" || true)"
[[ "$DNS_COUNT" -gt 0 ]] || warn "nessun record IPv4 rilevato"
[[ "$DNS_EXPECTED_MATCH" -gt 0 ]] && report "DNS verso NPM atteso: OK" || warn "DNS non punta all'NPM atteso ${EXPECTED_NPM_IP}"

log "[4/5] HTTPS pubblico"
PUBLIC_HEADERS="${WORKDIR}/07_PUBLIC_HTTPS_HEADERS.txt"
PUBLIC_BODY="${WORKDIR}/08_PUBLIC_HTTPS_BODY.html"
PUBLIC_CODE="$("$CURL_BIN" -k -L --connect-timeout 5 --max-time 15 -D "$PUBLIC_HEADERS" -o "$PUBLIC_BODY" -sS -w '%{http_code}' "$PUBLIC_URL" 2>>"$LOGFILE" || true)"
PUBLIC_SIZE="$(wc -c <"$PUBLIC_BODY" 2>/dev/null | tr -d ' ' || printf '0')"
{
  printf 'voce\tvalore\n'
  printf 'public_https_code\t%s\n' "$PUBLIC_CODE"
  printf 'public_body_bytes\t%s\n' "$PUBLIC_SIZE"
} >"${WORKDIR}/09_PUBLIC_HTTPS_RESULT.tsv"

if [[ "$PUBLIC_CODE" == "200" ]]; then
  report "HTTPS pubblico dal server: OK"
elif [[ "$PUBLIC_CODE" == "000" ]]; then
  warn "HTTPS pubblico non raggiungibile dal 215.6; il vhost locale e' comunque operativo"
else
  warn "HTTPS pubblico dal server risponde ${PUBLIC_CODE}"
fi

log "[5/5] Esito"
{
  echo "AUDIT COMPLETATO"
  echo "Errori: $FAILURES"
  echo "Avvisi: $WARNINGS"
  echo "Vhost locale HTTP: $LOCAL_CODE"
  echo "DNS verso NPM atteso: $([[ "$DNS_EXPECTED_MATCH" -gt 0 ]] && echo OK || echo DA_VERIFICARE)"
  echo "HTTPS pubblico visto dal 215.6: $PUBLIC_CODE"
  echo "Nessuna modifica eseguita."
} >"${WORKDIR}/99_SUMMARY.txt"

log "AUDIT COMPLETATO: errori=${FAILURES}, avvisi=${WARNINGS}"