#!/usr/bin/env bash
set -euo pipefail
LAST="$HOME/.ev424_doc_last_run"
[ -s "$LAST" ] || { echo "ERROR: missing last-run pointer: $LAST"; exit 2; }
# shellcheck disable=SC1090
# BEGIN EV424 G06 DATA-ONLY POINTER PARSER
unset RUN_DIR SOURCE URL ISSUED_DATE
declare -A EV424_POINTER_SEEN=()
while IFS= read -r EV424_POINTER_LINE || [ -n "$EV424_POINTER_LINE" ]; do
  if [[ ! "$EV424_POINTER_LINE" =~ ^([A-Z][A-Z0-9_]*)=\"([^\"]*)\"$ ]]; then
    echo "ERROR: invalid last-run pointer line" >&2
    exit 2
  fi
  EV424_POINTER_KEY="${BASH_REMATCH[1]}"
  EV424_POINTER_VALUE="${BASH_REMATCH[2]}"
  case "$EV424_POINTER_KEY" in
    RUN_DIR|SOURCE|URL|ISSUED_DATE) ;;
    *) echo "ERROR: unexpected pointer key: $EV424_POINTER_KEY" >&2; exit 2 ;;
  esac
  if [ -n "${EV424_POINTER_SEEN[$EV424_POINTER_KEY]+x}" ]; then
    echo "ERROR: duplicate pointer key: $EV424_POINTER_KEY" >&2
    exit 2
  fi
  EV424_POINTER_SEEN["$EV424_POINTER_KEY"]=1
  case "$EV424_POINTER_VALUE" in
    *'$('*|*'`'*) echo "ERROR: shell command substitution signal in pointer value" >&2; exit 2 ;;
  esac
  printf -v "$EV424_POINTER_KEY" "%s" "$EV424_POINTER_VALUE"
done < "$LAST"
if [ -z "${RUN_DIR+x}" ] || [ -z "${RUN_DIR}" ]; then
  echo "ERROR: missing required pointer key: RUN_DIR" >&2
  exit 2
fi
if [ -z "${SOURCE+x}" ] || [ -z "${SOURCE}" ]; then
  echo "ERROR: missing required pointer key: SOURCE" >&2
  exit 2
fi
if [ -z "${URL+x}" ] || [ -z "${URL}" ]; then
  echo "ERROR: missing required pointer key: URL" >&2
  exit 2
fi
EV424_RUN_ROOT="/var/lib/ev424/ev424_evidence"
EV424_RUN_ROOT_CANONICAL="$(readlink -f -- "$EV424_RUN_ROOT")" || { echo "ERROR: allowed run root cannot be resolved" >&2; exit 2; }
EV424_RUN_DIR_CANONICAL="$(readlink -f -- "$RUN_DIR")" || { echo "ERROR: RUN_DIR cannot be resolved" >&2; exit 2; }
if [ "$RUN_DIR" != "$EV424_RUN_DIR_CANONICAL" ]; then
  echo "ERROR: RUN_DIR is not canonical" >&2
  exit 2
fi
case "$EV424_RUN_DIR_CANONICAL" in
  "$EV424_RUN_ROOT_CANONICAL"/*) ;;
  *) echo "ERROR: RUN_DIR outside allowed root" >&2; exit 2 ;;
esac
if [ -n "${SOURCE+x}" ]; then
  if [ -z "$SOURCE" ] || [ "$SOURCE" != "$(basename -- "$SOURCE")" ] || [ "$SOURCE" = "." ] || [ "$SOURCE" = ".." ]; then
    echo "ERROR: SOURCE is not a valid basename" >&2
    exit 2
  fi
fi
unset EV424_POINTER_LINE EV424_POINTER_KEY EV424_POINTER_VALUE
unset EV424_RUN_ROOT EV424_RUN_ROOT_CANONICAL
unset EV424_RUN_DIR_CANONICAL EV424_POINTER_SEEN
# END EV424 G06 DATA-ONLY POINTER PARSER
: "${RUN_DIR:?}"; : "${SOURCE:?}"; : "${URL:?}"

  # Safety gate: prevent stale last-run continuation (FACT-only)
  TODAY=$(date +%F)
  RUN_DATE=$(basename "$(dirname "$RUN_DIR")")
  if [ -z "${TODAY:-}" ]; then TODAY=EMPTY; fi
  if [ -z "${RUN_DATE:-}" ]; then RUN_DATE=EMPTY; fi
  if [ "${RUN_DATE}" != "${TODAY}" ]; then
    echo "FAILURE_FACT_PACK"
    echo "FAILED_CHECK: STALE_LAST_RUN_POINTER"
    echo "OBSERVABLES:"
    echo "- TODAY_YYYY-MM-DD: ${TODAY}"
    echo "- RUN_DIR_DATE: ${RUN_DATE}"
    echo "- RUN_DIR: ${RUN_DIR}"
    exit 2
  fi
cd "$RUN_DIR"
[ -e "$SOURCE" ] && { echo "ERROR: Local file already exists (overwrite forbidden): $RUN_DIR/$SOURCE"; exit 2; }
curl -A "EV424 ev424.verify@gmail.com" -fsSL --connect-timeout 6 --max-time 25 "$URL" -o "$SOURCE"

BODY_BYTES="$(stat -c%s "$SOURCE" 2>/dev/null || echo 0)"
BODY_MAGIC="$(head -c 5 "$SOURCE" 2>/dev/null || true)"

echo "=== STEP2_BODY_VALIDATION (FACT) ==="
echo "LOCAL_BYTES=$BODY_BYTES"
echo "LOCAL_MAGIC=$BODY_MAGIC"

if [ "${BODY_BYTES:-0}" -lt 1024 ] || [ "$BODY_MAGIC" != "%PDF-" ]; then
  echo "FAILURE_FACT_PACK"
  echo "FAILED_CHECK: STEP2_LOCAL_BODY_NOT_PDF_OR_TOO_SMALL"
  echo "OBSERVABLES:"
  echo "- LOCAL_FILE: $RUN_DIR/$SOURCE"
  echo "- LOCAL_BYTES: $BODY_BYTES"
  echo "- LOCAL_MAGIC: $BODY_MAGIC"
  exit 2
fi

LOCAL_SHA="$(sha256sum "$SOURCE" | awk "{print \$1}")"
echo "=== STEP2_LOCAL_SHA (FACT) ==="
echo "LOCAL_FILE=$RUN_DIR/$SOURCE"
echo "LOCAL_SHA256=$LOCAL_SHA"
echo "$LOCAL_SHA  $SOURCE" > local.sha256
sha256sum local.sha256 | awk "{print \"LOCAL_SHA256_RECORD_SHA256=\" \$1}"
sha256sum -c local.sha256
