#!/bin/bash
set -Eeuo pipefail

# Resident HoloLake update bridge for JD-FD-PRIMARY under the Guanghu
# supervisor. The release origin remains loopback-only. A dedicated,
# port-forwarding-only SSH identity exposes exactly one loopback port on the
# registered BS-GZ-006 HTTPS front door.

readonly RELEASE_SERVER=/opt/guanghu/hololake-release-broadcast-candidate/current/server.mjs
readonly RELEASE_STATE_ROOT=/var/lib/guanghu/hololake-release-broadcast
readonly RELEASE_PORT=3940
readonly TUNNEL_KEY=/etc/guanghu/secrets/hololake-release-tunnel-ed25519
readonly TUNNEL_KNOWN_HOSTS=/etc/guanghu/secrets/hololake-release-tunnel-known-hosts
readonly FRONT_DOOR_HOST=43.139.217.141
readonly FRONT_DOOR_USER=hololake-tunnel
readonly FRONT_DOOR_PORT=19440

declare -a CHILDREN=()

cleanup() {
  trap - EXIT INT TERM
  for pid in "${CHILDREN[@]:-}"; do
    kill "$pid" 2>/dev/null || true
  done
  wait 2>/dev/null || true
}
trap cleanup EXIT INT TERM

require_exact_runtime() {
  [[ -f $RELEASE_SERVER && ! -L $RELEASE_SERVER ]] || {
    # current is an audited immutable-release symlink; resolve it and reject a
    # non-regular final target rather than following arbitrary path material.
    local resolved
    resolved=$(readlink -f "$RELEASE_SERVER")
    [[ $resolved == /opt/guanghu/hololake-release-broadcast-candidate/*/server.mjs ]]
    [[ -f $resolved && ! -L $resolved ]]
  }
  [[ -f $TUNNEL_KEY && ! -L $TUNNEL_KEY ]]
  [[ -f $TUNNEL_KNOWN_HOSTS && ! -L $TUNNEL_KNOWN_HOSTS ]]
  [[ $(stat -c '%a' "$TUNNEL_KEY") == 600 ]]
}

start_pair() {
  CHILDREN=()
  /usr/bin/setpriv --reuid=989 --regid=989 --init-groups --inh-caps=-all --reset-env \
    /usr/bin/env HOME=/nonexistent USER=hololake-release LOGNAME=hololake-release \
    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
    HOLOLAKE_RELEASE_HOST=127.0.0.1 HOLOLAKE_RELEASE_PORT="$RELEASE_PORT" \
    HOLOLAKE_RELEASE_STATE_ROOT="$RELEASE_STATE_ROOT" \
    /usr/bin/node "$RELEASE_SERVER" &
  CHILDREN+=("$!")

  /usr/bin/ssh -N \
    -i "$TUNNEL_KEY" -o IdentitiesOnly=yes -o BatchMode=yes \
    -o UserKnownHostsFile="$TUNNEL_KNOWN_HOSTS" -o StrictHostKeyChecking=yes \
    -o ExitOnForwardFailure=yes -o ServerAliveInterval=20 -o ServerAliveCountMax=3 \
    -R "127.0.0.1:${FRONT_DOOR_PORT}:127.0.0.1:${RELEASE_PORT}" \
    "${FRONT_DOOR_USER}@${FRONT_DOOR_HOST}" &
  CHILDREN+=("$!")
}

main() {
  require_exact_runtime
  while :; do
    start_pair
    wait -n "${CHILDREN[@]}" || true
    for pid in "${CHILDREN[@]}"; do kill "$pid" 2>/dev/null || true; done
    wait 2>/dev/null || true
    sleep 2
  done
}

main "$@"