#!/usr/bin/env bash
set -euo pipefail
LAST="$HOME/.ev424_doc_last_run"
[ -s "$LAST" ] || { echo "ERROR: missing last-run pointer: $LAST"; exit 2; }
# shellcheck disable=SC1090
# BEGIN EV424 G06 DATA-ONLY POINTER PARSER
unset RUN_DIR SOURCE URL ISSUED_DATE
declare -A EV424_POINTER_SEEN=()
while IFS= read -r EV424_POINTER_LINE || [ -n "$EV424_POINTER_LINE" ]; do
  if [[ ! "$EV424_POINTER_LINE" =~ ^([A-Z][A-Z0-9_]*)=\"([^\"]*)\"$ ]]; then
    echo "ERROR: invalid last-run pointer line" >&2
    exit 2
  fi
  EV424_POINTER_KEY="${BASH_REMATCH[1]}"
  EV424_POINTER_VALUE="${BASH_REMATCH[2]}"
  case "$EV424_POINTER_KEY" in
    RUN_DIR|SOURCE|URL|ISSUED_DATE) ;;
    *) echo "ERROR: unexpected pointer key: $EV424_POINTER_KEY" >&2; exit 2 ;;
  esac
  if [ -n "${EV424_POINTER_SEEN[$EV424_POINTER_KEY]+x}" ]; then
    echo "ERROR: duplicate pointer key: $EV424_POINTER_KEY" >&2
    exit 2
  fi
  EV424_POINTER_SEEN["$EV424_POINTER_KEY"]=1
  case "$EV424_POINTER_VALUE" in
    *'$('*|*'`'*) echo "ERROR: shell command substitution signal in pointer value" >&2; exit 2 ;;
  esac
  printf -v "$EV424_POINTER_KEY" "%s" "$EV424_POINTER_VALUE"
done < "$LAST"
if [ -z "${RUN_DIR+x}" ] || [ -z "${RUN_DIR}" ]; then
  echo "ERROR: missing required pointer key: RUN_DIR" >&2
  exit 2
fi
if [ -z "${SOURCE+x}" ] || [ -z "${SOURCE}" ]; then
  echo "ERROR: missing required pointer key: SOURCE" >&2
  exit 2
fi
if [ -z "${URL+x}" ] || [ -z "${URL}" ]; then
  echo "ERROR: missing required pointer key: URL" >&2
  exit 2
fi
EV424_RUN_ROOT="/var/lib/ev424/ev424_evidence"
EV424_RUN_ROOT_CANONICAL="$(readlink -f -- "$EV424_RUN_ROOT")" || { echo "ERROR: allowed run root cannot be resolved" >&2; exit 2; }
EV424_RUN_DIR_CANONICAL="$(readlink -f -- "$RUN_DIR")" || { echo "ERROR: RUN_DIR cannot be resolved" >&2; exit 2; }
if [ "$RUN_DIR" != "$EV424_RUN_DIR_CANONICAL" ]; then
  echo "ERROR: RUN_DIR is not canonical" >&2
  exit 2
fi
case "$EV424_RUN_DIR_CANONICAL" in
  "$EV424_RUN_ROOT_CANONICAL"/*) ;;
  *) echo "ERROR: RUN_DIR outside allowed root" >&2; exit 2 ;;
esac
if [ -n "${SOURCE+x}" ]; then
  if [ -z "$SOURCE" ] || [ "$SOURCE" != "$(basename -- "$SOURCE")" ] || [ "$SOURCE" = "." ] || [ "$SOURCE" = ".." ]; then
    echo "ERROR: SOURCE is not a valid basename" >&2
    exit 2
  fi
fi
unset EV424_POINTER_LINE EV424_POINTER_KEY EV424_POINTER_VALUE
unset EV424_RUN_ROOT EV424_RUN_ROOT_CANONICAL
unset EV424_RUN_DIR_CANONICAL EV424_POINTER_SEEN
# END EV424 G06 DATA-ONLY POINTER PARSER
: "${RUN_DIR:?}"; : "${SOURCE:?}"; : "${URL:?}"
cd "$RUN_DIR"
[ -e "$SOURCE" ] || { echo "ERROR: missing local file: $RUN_DIR/$SOURCE"; exit 2; }

LOCAL_SHA="$(sha256sum "$SOURCE" | awk "{print \$1}")"
  T="redownload.tmp"
  [ -e "$T" ] && { echo "ERROR: overwrite forbidden: $RUN_DIR/$T"; exit 2; }
  [ -e redownload.sha256 ] && { echo "ERROR: overwrite forbidden: $RUN_DIR/redownload.sha256"; exit 2; }
  [ -e redownload.sha256.sha256 ] && { echo "ERROR: overwrite forbidden: $RUN_DIR/redownload.sha256.sha256"; exit 2; }
curl -A "EV424 ev424.verify@gmail.com" -fsSL --connect-timeout 6 --max-time 25 "$URL" -o "$T"
REMOTE_SHA="$(sha256sum "$T" | awk "{print \$1}")"

echo "=== STEP3_REDOWNLOAD (FACT) ==="
echo "LOCAL_SHA256=$LOCAL_SHA"
echo "REMOTE_SHA256=$REMOTE_SHA"
if [ "$LOCAL_SHA" = "$REMOTE_SHA" ]; then
  echo "CHECK_REDOWNLOAD=PASS"
else
  echo "CHECK_REDOWNLOAD=FAIL"
  exit 1
fi
  echo "$REMOTE_SHA  $T" > redownload.sha256
  sha256sum -c redownload.sha256 >/dev/null
  sha256sum redownload.sha256 | tee redownload.sha256.sha256 | awk '{print "REDOWNLOAD_RECORD_SHA256="$1}'
