#!/bin/bash
# =============================================================================
# plugin/sbin/podman-verify-packages.sh
#
# "Pakete prüfen" — verifies the seven packages this plugin ships are
# actually installed, at the version the plugin expects, and that the
# backed-up .txz copies (see podman-backup.sh) haven't bit-rotted on disk.
#
# Three checks per package:
#   1. Installed: Slackware records every installed package under
#      /var/log/packages/<name>-<version>-<arch>-<build><tag> — its mere
#      existence IS the install record (standard Slackware pkgtools
#      convention, nothing custom here).
#   2. Expected version: compared against
#      /usr/local/share/unraid-podman/installed-versions.env, written by
#      plugin/podman.plg's postinstall step at install/update time.
#   3. Backup integrity: if a backed-up .txz exists for the installed
#      version (see podman-backup.sh), its current SHA256 is re-checked
#      against the .sha256 sidecar recorded at build time — catches flash
#      storage corruption on the backup copy before it's needed for a
#      rollback.
#
# Usage:
#   podman-verify-packages.sh            # human-readable report
#   podman-verify-packages.sh --quiet    # exit code only, minimal output
#
# Exit code: 0 if everything checks out, 1 if any package has a problem.
# =============================================================================

set -u

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=./podman-common.sh
. "$SCRIPT_DIR/podman-common.sh"

INSTALLED_VERSIONS_FILE="/usr/local/share/unraid-podman/installed-versions.env"
PACKAGES="podman conmon crun netavark aardvark-dns passt fuse-overlayfs unraid-podman"

QUIET=0
[ "${1:-}" = "--quiet" ] && QUIET=1

report() {
  [ "$QUIET" -eq 0 ] && echo "$1"
}

if [ ! -f "$INSTALLED_VERSIONS_FILE" ]; then
  podman_log_error "verify: $INSTALLED_VERSIONS_FILE missing — plugin install metadata not found"
  exit 1
fi
# shellcheck source=/dev/null
. "$INSTALLED_VERSIONS_FILE"

if [ -z "${PLUGIN_VERSION:-}" ]; then
  podman_log_error "verify: PLUGIN_VERSION not recorded in $INSTALLED_VERSIONS_FILE"
  exit 1
fi

PROBLEMS=0

for name in $PACKAGES; do
  entity_prefix=$(echo "$name" | tr '[:lower:]-' '[:upper:]_')
  expected_version_var="${entity_prefix}_INSTALLED_VERSION"
  expected_version="${!expected_version_var:-}"

  report "== $name =="

  if [ -z "$expected_version" ]; then
    report "  expected version:  UNKNOWN (not recorded in $INSTALLED_VERSIONS_FILE)"
    PROBLEMS=$((PROBLEMS + 1))
    continue
  fi
  report "  expected version:  $expected_version"

  # --- Check 1: installed -----------------------------------------------
  installed_record=$(find /var/log/packages -maxdepth 1 -name "${name}-*" -print 2> /dev/null | head -n1)
  if [ -z "$installed_record" ]; then
    report "  installed:         NO"
    podman_log_error "verify: $name is not installed (no /var/log/packages/$name-* record)"
    PROBLEMS=$((PROBLEMS + 1))
    continue
  fi
  installed_basename=$(basename "$installed_record")
  report "  installed package: $installed_basename"

  # --- Check 2: version matches expectation ------------------------------
  case "$installed_basename" in
    "${name}-${expected_version}-"*)
      report "  version match:     OK"
      ;;
    *)
      report "  version match:     MISMATCH (installed record does not match expected $expected_version)"
      podman_log_error "verify: $name installed record '$installed_basename' does not match expected version $expected_version"
      PROBLEMS=$((PROBLEMS + 1))
      ;;
  esac

  # --- Check 3: backup artifact integrity, if present --------------------
  # Packages of all 7 components released together as one plugin version
  # are grouped under a single PLUGIN_VERSION directory (not per-component
  # version) — a rollback targets "go back to plugin release X", matching
  # podman-backup.sh's restore-packages <plugin-version>.
  backup_dir="$PODMAN_BACKUP_DIR/packages/$PLUGIN_VERSION"
  backup_txz=$(find "$backup_dir" -maxdepth 1 -name "${name}-*.txz" 2> /dev/null | head -n1)
  if [ -n "$backup_txz" ] && [ -f "$backup_txz.sha256" ]; then
    if ( cd "$(dirname "$backup_txz")" && sha256sum -c "$(basename "$backup_txz").sha256" > /dev/null 2>&1 ); then
      report "  backup integrity:  OK ($backup_txz)"
    else
      report "  backup integrity:  CORRUPT ($backup_txz)"
      podman_log_error "verify: backup artifact $backup_txz failed checksum verification"
      PROBLEMS=$((PROBLEMS + 1))
    fi
  else
    report "  backup integrity:  no backup artifact on file (nothing to verify)"
  fi
done

report ""
if [ "$PROBLEMS" -gt 0 ]; then
  report "$PROBLEMS problem(s) found."
  podman_notify "Podman package verification found problems" \
    "$PROBLEMS issue(s) found — see $PODMAN_PLUGIN_LOG for details." \
    "warning"
  exit 1
fi

report "All packages verified OK."
exit 0