#!/usr/bin/env bash
set -euo pipefail

CONTAINER="gal2-node"

EXPECTED_IMAGE_CONFIG_ID="sha256:abc2c606cba0e2b755398c51fd6919e5d8f2c880ebda11def76f6c8be567ad9f"
EXPECTED_IMAGE_MANIFEST_ID="sha256:497ab1646033ecbb28504489c874f6eda80b12507a7bd3ca4f2cb498fb471f9d"
EXPECTED_IMAGE_TAG="gal2-node:rc11-amd64-evaluator-c8515d4"
EXPECTED_PRODUCT="GAL-2-Node"
EXPECTED_RELEASE="v1.0.0-rc11"
EXPECTED_SHM_LAYOUT="1.0"
EXPECTED_MANAGER="gal2-node.service"

fail() {
    echo "ERROR: $*" >&2
    exit 1
}

require_root() {
    [ "${EUID}" -eq 0 ] ||
        fail "container guard must run as root"
}

container_exists() {
    docker container inspect \
        "$CONTAINER" \
        >/dev/null 2>&1
}

verify_owned_container() {
    local image_id
    local image_tag
    local product
    local release
    local shm_layout
    local manager

    image_id="$(
        docker container inspect \
            "$CONTAINER" \
            --format '{{.Image}}'
    )"

    image_tag="$(
        docker container inspect \
            "$CONTAINER" \
            --format '{{.Config.Image}}'
    )"

    product="$(
        docker container inspect \
            "$CONTAINER" \
            --format '{{index .Config.Labels "com.gal2.product"}}'
    )"

    release="$(
        docker container inspect \
            "$CONTAINER" \
            --format '{{index .Config.Labels "com.gal2.release"}}'
    )"

    shm_layout="$(
        docker container inspect \
            "$CONTAINER" \
            --format '{{index .Config.Labels "com.gal2.shm.layout"}}'
    )"

    manager="$(
        docker container inspect \
            "$CONTAINER" \
            --format '{{index .Config.Labels "com.gal2.managed-by"}}'
    )"

    if
        [ "$image_id" != "$EXPECTED_IMAGE_CONFIG_ID" ] &&
        [ "$image_id" != "$EXPECTED_IMAGE_MANIFEST_ID" ]
    then
        fail "container name collision: unexpected image object"
    fi

    [ "$image_tag" = "$EXPECTED_IMAGE_TAG" ] ||
        fail "container name collision: unexpected image tag"

    [ "$product" = "$EXPECTED_PRODUCT" ] ||
        fail "container name collision: missing GAL-2 product identity"

    [ "$release" = "$EXPECTED_RELEASE" ] ||
        fail "container name collision: unexpected GAL-2 release identity"

    [ "$shm_layout" = "$EXPECTED_SHM_LAYOUT" ] ||
        fail "container name collision: unexpected SHM identity"

    [ "$manager" = "$EXPECTED_MANAGER" ] ||
        fail "container name collision: container is not owned by gal2-node.service"
}

prestart() {
    if ! container_exists; then
        echo "GAL2_CONTAINER_COLLISION=ABSENT"
        return 0
    fi

    verify_owned_container

    echo "GAL2_EXISTING_CONTAINER=VERIFIED"
    docker rm -f "$CONTAINER"
}

stop_managed() {
    if ! container_exists; then
        echo "GAL2_CONTAINER=ABSENT"
        return 0
    fi

    verify_owned_container

    echo "GAL2_EXISTING_CONTAINER=VERIFIED"
    docker stop \
        --timeout 15 \
        "$CONTAINER"
}

require_root

command -v docker >/dev/null 2>&1 ||
    fail "docker command not found"

case "${1:-}" in
    prestart)
        prestart
        ;;

    stop)
        stop_managed
        ;;

    verify)
        if ! container_exists; then
            echo "GAL2_CONTAINER=ABSENT"
            exit 0
        fi

        verify_owned_container
        echo "GAL2_EXISTING_CONTAINER=VERIFIED"
        ;;

    *)
        echo "Usage: $0 {prestart|stop|verify}" >&2
        exit 2
        ;;
esac
