#!/usr/bin/env bash
set -euo pipefail
LAST="$HOME/.ev424_doc_last_run"
[ -s "$LAST" ] || { echo "ERROR: missing last-run pointer: $LAST"; exit 2; }
# shellcheck disable=SC1090
# BEGIN EV424 G06 DATA-ONLY POINTER PARSER
unset RUN_DIR SOURCE URL ISSUED_DATE
declare -A EV424_POINTER_SEEN=()
while IFS= read -r EV424_POINTER_LINE || [ -n "$EV424_POINTER_LINE" ]; do
  if [[ ! "$EV424_POINTER_LINE" =~ ^([A-Z][A-Z0-9_]*)=\"([^\"]*)\"$ ]]; then
    echo "ERROR: invalid last-run pointer line" >&2
    exit 2
  fi
  EV424_POINTER_KEY="${BASH_REMATCH[1]}"
  EV424_POINTER_VALUE="${BASH_REMATCH[2]}"
  case "$EV424_POINTER_KEY" in
    RUN_DIR|SOURCE|URL|ISSUED_DATE) ;;
    *) echo "ERROR: unexpected pointer key: $EV424_POINTER_KEY" >&2; exit 2 ;;
  esac
  if [ -n "${EV424_POINTER_SEEN[$EV424_POINTER_KEY]+x}" ]; then
    echo "ERROR: duplicate pointer key: $EV424_POINTER_KEY" >&2
    exit 2
  fi
  EV424_POINTER_SEEN["$EV424_POINTER_KEY"]=1
  case "$EV424_POINTER_VALUE" in
    *'$('*|*'`'*) echo "ERROR: shell command substitution signal in pointer value" >&2; exit 2 ;;
  esac
  printf -v "$EV424_POINTER_KEY" "%s" "$EV424_POINTER_VALUE"
done < "$LAST"
if [ -z "${RUN_DIR+x}" ] || [ -z "${RUN_DIR}" ]; then
  echo "ERROR: missing required pointer key: RUN_DIR" >&2
  exit 2
fi
if [ -z "${SOURCE+x}" ] || [ -z "${SOURCE}" ]; then
  echo "ERROR: missing required pointer key: SOURCE" >&2
  exit 2
fi
EV424_RUN_ROOT="/var/lib/ev424/ev424_evidence"
EV424_RUN_ROOT_CANONICAL="$(readlink -f -- "$EV424_RUN_ROOT")" || { echo "ERROR: allowed run root cannot be resolved" >&2; exit 2; }
EV424_RUN_DIR_CANONICAL="$(readlink -f -- "$RUN_DIR")" || { echo "ERROR: RUN_DIR cannot be resolved" >&2; exit 2; }
if [ "$RUN_DIR" != "$EV424_RUN_DIR_CANONICAL" ]; then
  echo "ERROR: RUN_DIR is not canonical" >&2
  exit 2
fi
case "$EV424_RUN_DIR_CANONICAL" in
  "$EV424_RUN_ROOT_CANONICAL"/*) ;;
  *) echo "ERROR: RUN_DIR outside allowed root" >&2; exit 2 ;;
esac
if [ -n "${SOURCE+x}" ]; then
  if [ -z "$SOURCE" ] || [ "$SOURCE" != "$(basename -- "$SOURCE")" ] || [ "$SOURCE" = "." ] || [ "$SOURCE" = ".." ]; then
    echo "ERROR: SOURCE is not a valid basename" >&2
    exit 2
  fi
fi
unset EV424_POINTER_LINE EV424_POINTER_KEY EV424_POINTER_VALUE
unset EV424_RUN_ROOT EV424_RUN_ROOT_CANONICAL
unset EV424_RUN_DIR_CANONICAL EV424_POINTER_SEEN
# END EV424 G06 DATA-ONLY POINTER PARSER
: "${RUN_DIR:?}"; : "${SOURCE:?}"
cd "$RUN_DIR"
MANIFEST="run_manifest.sha256"
[ -e "$MANIFEST" ] && { echo "ERROR: Manifest already exists (overwrite forbidden): $RUN_DIR/$MANIFEST"; exit 2; }
sha256sum "$SOURCE" > "$MANIFEST"
sha256sum "$MANIFEST" | tee "$MANIFEST.sha256" | awk "{print \"RUN_MANIFEST_SHA256=\" \$1}"
sha256sum -c "$MANIFEST.sha256"
grep -F "  $SOURCE" "$MANIFEST" >/dev/null || { echo "ERROR: SOURCE_NOT_IN_MANIFEST"; exit 1; }
echo "=== STEP4_CHAIN (FACT) ==="
sha256sum -c "$MANIFEST"
REP_SHA="$(sha256sum "$MANIFEST" | awk "{print \$1}")"
echo "REP_SHA256=$REP_SHA"
