#!/usr/bin/env bash
set -euo pipefail

[[ $# -eq 3 ]] || {
  echo "usage: set-native-default.sh <world-root> <recovery-root> <expected-candidate-sha256>" >&2
  exit 64
}
[[ ${EUID} -eq 0 ]] || {
  echo "must run as root" >&2
  exit 77
}

world_root=$(readlink -f "$1")
recovery_root=$(readlink -f "$2")
expected_candidate_sha=$3
[[ ${expected_candidate_sha} =~ ^[0-9a-f]{64}$ ]]
/guanghu/bin/ghctl authorize "${world_root}" overwrite_system_disk_and_exit_linux \
  >/dev/null
grep -q '^node_id: BS-SH-005$' "${world_root}/CURRENT.hldp"
grep -q "menuentry 'Guanghu OS native one-time proof'.*'guanghu-native-once'" \
  /boot/grub/grub.cfg
grep -q "menuentry 'Ubuntu'.*'gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71'" \
  /boot/grub/grub.cfg
grep -q "load_env --file '(hd0)68+2' guanghu_recovery" /boot/grub/grub.cfg

installed_sha=$(dd if=/dev/vda bs=512 skip=34 count=29 status=none |
  sha256sum | awk '{print $1}')
[[ ${installed_sha} == "${expected_candidate_sha}" ]]

cp /etc/default/grub "${recovery_root}/default-grub.before-native-default"
cp /boot/grub/grub.cfg "${recovery_root}/grub.cfg.before-native-default"
cp /boot/grub/grubenv "${recovery_root}/grubenv.before-native-default"

new_default=$(mktemp)
trap 'rm -f "${new_default}"' EXIT
awk '
  BEGIN { changed = 0 }
  /^GRUB_DEFAULT=/ {
    print "GRUB_DEFAULT=guanghu-native-once"
    changed = 1
    next
  }
  { print }
  END {
    if (!changed) {
      print "GRUB_DEFAULT=guanghu-native-once"
    }
  }
' /etc/default/grub >"${new_default}"
install -m 0644 "${new_default}" /etc/default/grub
update-grub >/dev/null

grep -q '^GRUB_DEFAULT=guanghu-native-once$' /etc/default/grub
grep -q 'set default="guanghu-native-once"' /boot/grub/grub.cfg
grep -q "menuentry 'Guanghu OS native one-time proof'.*'guanghu-native-once'" \
  /boot/grub/grub.cfg
grep -q "menuentry 'Ubuntu'.*'gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71'" \
  /boot/grub/grub.cfg
grep -q "load_env --file '(hd0)68+2' guanghu_recovery" /boot/grub/grub.cfg

grub-editenv /boot/grub/grubenv unset initrdfail prev_entry next_entry
grub_state=$(grub-editenv /boot/grub/grubenv list)
if grep -Eq '^(initrdfail|prev_entry|next_entry)=.+' <<<"${grub_state}"; then
  echo "stale GRUB one-time state remains" >&2
  exit 65
fi

observed_at=$(date --iso-8601=seconds)
cat >"${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp" <<EOF
schema: guanghu.native-default-receipt/v1
receipt_id: GH-OS-LAB-001-NATIVE-DEFAULT-001
status: CONFIGURED_NOT_REBOOTED
observed_at: ${observed_at}
node_id: BS-SH-005
instance_id: lhins-14w5y3ce
candidate:
  lba_start: 34
  sector_count: 29
  sha256: ${installed_sha}
grub:
  default_entry: guanghu-native-once
  ubuntu_recovery_entry: gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71
  native_recovery_protocol: GHNRP
  native_recovery_raw_blocklist: (hd0)68+2
  stale_one_time_state: CLEARED
rollback:
  recovery_root: ${recovery_root}
  default_grub_backed_up: true
  generated_grub_backed_up: true
  grubenv_backed_up: true
next_action: REBOOT_NATIVE_DEFAULT_THEN_PROVE_HLDP_RECOVER_OS_RETURNS_TO_UBUNTU
EOF
chmod 0400 "${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp"
sync
cat "${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp"