#!/usr/bin/env bash
# 使用本地假 HTTP 服务与假 MySQL 客户端验证狗粮账号预置脚本，不连接真实环境。
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
SCRIPT="$ROOT_DIR/deploy/provision-dogfood-users.sh"
TMP_DIR="$(mktemp -d)"
SERVER_PID=''

cleanup() {
  if [ -n "$SERVER_PID" ]; then
    kill "$SERVER_PID" 2>/dev/null || true
    wait "$SERVER_PID" 2>/dev/null || true
  fi
  rm -rf "$TMP_DIR"
}
trap cleanup EXIT

fail() {
  printf 'TEST_FAIL %s\n' "$*" >&2
  exit 1
}

# 服务状态同时供假 HTTP 服务与假 MySQL 查询读取；原子替换避免读到半写文件。
printf '{"accounts":{},"creators":{},"claims":[],"reconcileCalls":[]}\n' >"$TMP_DIR/state.json"

cat >"$TMP_DIR/fake-server.py" <<'PY'
import json
import os
import tempfile
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from socketserver import TCPServer

state_file = os.environ["DOGFOOD_FAKE_STATE"]
port_file = os.environ["DOGFOOD_FAKE_PORT_FILE"]
request_log = os.environ["DOGFOOD_FAKE_REQUEST_LOG"]
provisioning_run_id = os.environ["DOGFOOD_FAKE_PROVISIONING_RUN_ID"]
provisioning_capability = os.environ["DOGFOOD_FAKE_PROVISIONING_CAPABILITY"]


def load_state():
    with open(state_file, encoding="utf-8") as handle:
        return json.load(handle)


def save_state(state):
    directory = os.path.dirname(state_file)
    fd, temporary = tempfile.mkstemp(dir=directory)
    try:
        with os.fdopen(fd, "w", encoding="utf-8") as handle:
            json.dump(state, handle)
        os.replace(temporary, state_file)
    finally:
        if os.path.exists(temporary):
            os.unlink(temporary)


class Handler(BaseHTTPRequestHandler):
    def log_message(self, _format, *_args):
        return

    def response(self, payload, status=200):
        body = json.dumps(payload, separators=(",", ":")).encode()
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def json_body(self):
        length = int(self.headers.get("Content-Length", "0"))
        return json.loads(self.rfile.read(length) or b"{}")

    def record(self):
        with open(request_log, "a", encoding="utf-8") as handle:
            handle.write(f"{self.command} {self.path}\n")

    def do_GET(self):
        self.record()
        if self.path == "/app-api/ad/slot/list-enabled":
            self.response({"code": 1111002006, "data": None})
            return
        if self.path == "/app-api/trade/charge/points-balance" or self.path.startswith(
            "/app-api/trade/withdraw/page?"
        ):
            authorization = self.headers.get("Authorization")
            if authorization and authorization.startswith("Bearer fakeAccessTokenLogin"):
                self.response({"code": 1106008000, "data": None})
            else:
                # mock token 已关闭：test1 或无 token 都先被可信鉴权边界拒绝。
                self.response({"code": 401, "data": None}, 401)
            return
        self.response({"code": 404}, 404)

    def do_POST(self):
        self.record()
        body = self.json_body()
        if self.path == "/admin-api/system/auth/login":
            self.response({"code": 0, "data": {"accessToken": "fake-admin-token"}})
            return
        state = load_state()
        if self.path.startswith("/admin-api/aigc/quota/claims/") and self.path.endswith("/reconcile"):
            if self.headers.get("Authorization") not in (
                "Bearer fake-admin-token",
                "Bearer bootstrap-token-from-file",
            ):
                self.response({"code": 401, "msg": "未授权"}, 401)
                return
            try:
                user_id = int(self.path.split("/")[-2])
            except (ValueError, IndexError):
                self.response({"code": 400, "msg": "userId 非法"}, 400)
                return
            known_ids = {account["userId"] for account in state["accounts"].values()}
            if user_id not in known_ids:
                self.response({"code": 0, "data": False})
                return
            # 模拟后端唯一键与 CAS：重复补偿只记录调用，不增加第二条 claim。
            state["reconcileCalls"].append(user_id)
            if user_id not in state["claims"]:
                state["claims"].append(user_id)
            save_state(state)
            self.response({"code": 0, "data": True})
            return
        if self.path == "/app-api/passport/password-register":
            if (
                self.headers.get("X-Dogfood-Provisioning-Run-Id") != provisioning_run_id
                or self.headers.get("X-Dogfood-Provisioning-Capability") != provisioning_capability
            ):
                self.response({"code": 1002090007, "msg": "预置凭据错误"})
                return
            username = body.get("username", "")
            if username in state["accounts"]:
                self.response({"code": 1002090004, "msg": "用户名已存在"})
                return
            user_id = 1000 + len(state["accounts"]) + 1
            state["accounts"][username] = {
                "password": body.get("password", ""),
                "userId": user_id,
            }
            save_state(state)
            self.response({
                "code": 0,
                "data": {
                    "userId": user_id,
                    "accessToken": f"fakeAccessTokenRegister{user_id}",
                    "refreshToken": f"fakeRefreshTokenRegister{user_id}",
                },
            })
            return
        if self.path == "/app-api/passport/password-login":
            account = state["accounts"].get(body.get("username", ""))
            if not account or account["password"] != body.get("password"):
                self.response({"code": 1002090002, "msg": "账号或密码错误"})
                return
            self.response({
                "code": 0,
                "data": {
                    "userId": account["userId"],
                    "accessToken": f"fakeAccessTokenLogin{account['userId']}",
                    "refreshToken": f"fakeRefreshTokenLogin{account['userId']}",
                },
            })
            return
        self.response({"code": 404}, 404)

    def do_PUT(self):
        self.record()
        if self.path != "/admin-api/passport/player/set-creator":
            self.response({"code": 404}, 404)
            return
        body = self.json_body()
        state = load_state()
        user_id = body.get("userId")
        username = next(
            (name for name, account in state["accounts"].items() if account["userId"] == user_id),
            None,
        )
        if username is None:
            self.response({"code": 404}, 404)
            return
        state["creators"][username] = True
        save_state(state)
        self.response({"code": 0, "data": True})


class LocalThreadingHTTPServer(ThreadingHTTPServer):
    def server_bind(self):
        # 跳过 HTTPServer.server_bind 的反向 DNS 查询，离线构建机不能依赖主机名解析。
        TCPServer.server_bind(self)
        self.server_name, self.server_port = self.server_address[:2]

server = LocalThreadingHTTPServer(("127.0.0.1", 0), Handler)
with open(port_file, "w", encoding="utf-8") as handle:
    handle.write(str(server.server_port))
server.serve_forever()
PY

cat >"$TMP_DIR/mysql" <<'SH'
#!/usr/bin/env bash
# 根据 SQL 返回聚合计数或 40 个目标账号中缺失 claim 的 userId。
set -euo pipefail
sql="$(cat)"
DOGFOOD_FAKE_SQL="$sql" python3 - "$DOGFOOD_FAKE_STATE" <<'PY'
import json
import hashlib
import os
import re
import sys

with open(sys.argv[1], encoding="utf-8") as handle:
    state = json.load(handle)
accounts = len(state["accounts"])
creators = len(state["creators"])
claims = state["claims"]
free = 52 - len(claims)
mode = os.environ.get("DOGFOOD_FAKE_COUNTS_MODE", "all")
duplicates = 1 if mode == "duplicate" else 0
sql = os.environ["DOGFOOD_FAKE_SQL"]
if "FROM system_oauth2_access_token a" in sql:
    tokens = re.findall(r"a\.access_token='([A-Za-z0-9_-]+)'.*r\.refresh_token='([A-Za-z0-9_-]+)'", sql, re.S)
    if len(tokens) != 1:
        raise SystemExit("OAuth 主键查询没有携带唯一 token 对")
    access_token, refresh_token = tokens[0]
    numeric = int(re.search(r"([0-9]+)$", access_token).group(1))
    kind_offset = 0 if "Register" in access_token else 100000
    print(
        numeric + kind_offset,
        numeric + kind_offset + 500000,
        hashlib.sha256(access_token.encode()).hexdigest(),
        hashlib.sha256(refresh_token.encode()).hexdigest(),
        sep="\t",
    )
    raise SystemExit(0)
if "SELECT p.id" in sql:
    missing = sorted(
        account["userId"] for account in state["accounts"].values()
        if account["userId"] not in claims
    )
    if os.environ.get("DOGFOOD_FAKE_MISSING_MODE") == "rogue":
        missing.append(999999)
    print(*missing, sep="\n")
    raise SystemExit(0)
print(accounts, creators, 0, len(claims), duplicates, free, sep="\t")
PY
SH
chmod +x "$TMP_DIR/mysql"

cat >"$TMP_DIR/ssh" <<'SH'
#!/usr/bin/env bash
# 模拟远端查询：SQL 必须只经 stdin 传入，不能藏在可见进程参数中。
set -euo pipefail
sql="$(cat)"
[[ "$*" != *'fakeAccessToken'* && "$*" != *'fakeRefreshToken'* ]] || {
  printf '远端命令参数泄漏 OAuth bearer\n' >&2
  exit 2
}
case "$sql" in
  *'SELECT COUNT(DISTINCT p.id)'*|*'SELECT p.id'*|*'FROM system_oauth2_access_token a'*) ;;
  *) printf '远端未从 stdin 收到完整狗粮账号 SQL\n' >&2; exit 2 ;;
esac
DOGFOOD_FAKE_SQL="$sql" python3 - "$DOGFOOD_FAKE_STATE" <<'PY'
import json
import hashlib
import os
import re
import sys

with open(sys.argv[1], encoding="utf-8") as handle:
    state = json.load(handle)
accounts = len(state["accounts"])
creators = len(state["creators"])
claims = state["claims"]
mode = os.environ.get("DOGFOOD_FAKE_COUNTS_MODE", "all")
duplicates = 1 if mode == "duplicate" else 0
sql = os.environ["DOGFOOD_FAKE_SQL"]
if "FROM system_oauth2_access_token a" in sql:
    tokens = re.findall(r"a\.access_token='([A-Za-z0-9_-]+)'.*r\.refresh_token='([A-Za-z0-9_-]+)'", sql, re.S)
    if len(tokens) != 1:
        raise SystemExit("远端 OAuth 主键查询没有携带唯一 token 对")
    access_token, refresh_token = tokens[0]
    numeric = int(re.search(r"([0-9]+)$", access_token).group(1))
    kind_offset = 0 if "Register" in access_token else 100000
    print(
        numeric + kind_offset,
        numeric + kind_offset + 500000,
        hashlib.sha256(access_token.encode()).hexdigest(),
        hashlib.sha256(refresh_token.encode()).hexdigest(),
        sep="\t",
    )
    raise SystemExit(0)
if "SELECT p.id" in sql:
    missing = sorted(
        account["userId"] for account in state["accounts"].values()
        if account["userId"] not in claims
    )
    if os.environ.get("DOGFOOD_FAKE_MISSING_MODE") == "rogue":
        missing.append(999999)
    print(*missing, sep="\n")
    raise SystemExit(0)
print(accounts, creators, 0, len(claims), duplicates, 52 - len(claims), sep="\t")
PY
SH
chmod +x "$TMP_DIR/ssh"

DOGFOOD_FAKE_STATE="$TMP_DIR/state.json" \
DOGFOOD_FAKE_PORT_FILE="$TMP_DIR/port" \
DOGFOOD_FAKE_REQUEST_LOG="$TMP_DIR/requests.log" \
DOGFOOD_FAKE_PROVISIONING_RUN_ID='dogfood-test-run-001' \
DOGFOOD_FAKE_PROVISIONING_CAPABILITY='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' \
  python3 "$TMP_DIR/fake-server.py" >"$TMP_DIR/server.log" 2>&1 &
SERVER_PID=$!
for _ in $(seq 1 300); do
  [ -s "$TMP_DIR/port" ] && break
  sleep 0.1
done
[ -s "$TMP_DIR/port" ] || fail "假 HTTP 服务未启动"
PORT="$(<"$TMP_DIR/port")"

run_provision() {
  local log_file="$1"
  local mysql_ssh_host="${2:-}"
  local expected="${3:-pass}"
  if ! PROVISION_ACK='PROVISION_DOGFOOD_40_USERS_WITH_TEMP_CONFIG' \
      DOGFOOD_PASSWORD_SEED='test-seed-must-not-appear' \
      DOGFOOD_PROVISION_RUN_ID='dogfood-test-run-001' \
      DOGFOOD_PROVISION_CAPABILITY='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' \
      ADMIN_TOKEN_FILE="$TMP_DIR/bootstrap-admin.token" \
      BASE="http://127.0.0.1:$PORT" \
      MYSQL_BIN="$TMP_DIR/mysql" \
      MYSQL_PASSWORD='fake-mysql-password' \
      MYSQL_SSH_HOST="$mysql_ssh_host" \
      DOGFOOD_FAKE_COUNTS_MODE="${DOGFOOD_FAKE_COUNTS_MODE:-all}" \
      DOGFOOD_FAKE_MISSING_MODE="${DOGFOOD_FAKE_MISSING_MODE:-}" \
      DOGFOOD_FAKE_STATE="$TMP_DIR/state.json" \
      DOGFOOD_ACCOUNTS_FILE="$TMP_DIR/dogfood-accounts.tsv" \
      VERIFY_TIMEOUT_SEC=2 \
      PATH="$TMP_DIR:$PATH" \
        "$SCRIPT" >"$log_file" 2>&1; then
    [ "$expected" = fail ] && return 0
    sed -n '1,160p' "$log_file" >&2
    fail "预置脚本执行失败"
  fi
  [ "$expected" = pass ] || fail "缺失 claim 的终验场景被错误放行：$DOGFOOD_FAKE_COUNTS_MODE"
}

printf 'bootstrap-token-from-file\n' >"$TMP_DIR/bootstrap-admin.token"
chmod 600 "$TMP_DIR/bootstrap-admin.token"

# 第一遍模拟 40 条注册消息全部异常：账号已创建但 claim 全缺，脚本必须逐个主动补偿。
run_provision "$TMP_DIR/first.log"
! rg -q '^POST /admin-api/system/auth/login$' "$TMP_DIR/requests.log" || \
  fail "ADMIN_TOKEN_FILE 场景仍触发 admin 密码登录"
for protected_path in \
  '/app-api/ad/slot/list-enabled' \
  '/app-api/trade/charge/points-balance' \
  '/app-api/trade/withdraw/page'; do
  rg -q "^GET ${protected_path}" "$TMP_DIR/requests.log" || fail "未预检安全守卫：$protected_path"
done
python3 - "$TMP_DIR/state.json" <<'PY'
import json, sys
with open(sys.argv[1], encoding="utf-8") as handle:
    state = json.load(handle)
assert len(state["claims"]) == 40, state
assert len(state["reconcileCalls"]) == 40, state
state["reconcileCalls"] = []
with open(sys.argv[1], "w", encoding="utf-8") as handle:
    json.dump(state, handle)
PY

# 第二遍覆盖“账号已存在且 claim 已齐”的幂等路径：不得调用任何补偿接口。
run_provision "$TMP_DIR/second.log"
python3 - "$TMP_DIR/state.json" <<'PY'
import json, sys
with open(sys.argv[1], encoding="utf-8") as handle:
    state = json.load(handle)
assert state["reconcileCalls"] == [], state
# 制造一个“账号已存在但 claim 缺失”的历史失败，再验证只修这一人。
state["claims"].remove(1007)
with open(sys.argv[1], "w", encoding="utf-8") as handle:
    json.dump(state, handle)
PY
run_provision "$TMP_DIR/recover-one.log"
python3 - "$TMP_DIR/state.json" <<'PY'
import json, sys
with open(sys.argv[1], encoding="utf-8") as handle:
    state = json.load(handle)
assert state["reconcileCalls"] == [1007], state
assert len(state["claims"]) == 40, state
state["reconcileCalls"] = []
with open(sys.argv[1], "w", encoding="utf-8") as handle:
    json.dump(state, handle)
PY

# 第三遍覆盖从开发机调用时的远端 MySQL 只读查询传参路径。
run_provision "$TMP_DIR/remote.log" 'fake-remote'

[ "$(wc -l <"$TMP_DIR/dogfood-accounts.tsv" | tr -d ' ')" = '41' ] || fail "凭据文件行数不是 40+表头"
grep -q $'^dogfoodc01\tcreator\t' "$TMP_DIR/dogfood-accounts.tsv" || fail "缺少 dogfoodc01"
grep -q $'^dogfoodc10\tcreator\t' "$TMP_DIR/dogfood-accounts.tsv" || fail "缺少 dogfoodc10"
grep -q $'^dogfoodp01\tplayer\t' "$TMP_DIR/dogfood-accounts.tsv" || fail "缺少 dogfoodp01"
grep -q $'^dogfoodp30\tplayer\t' "$TMP_DIR/dogfood-accounts.tsv" || fail "缺少 dogfoodp30"

mode="$(stat -c '%a' "$TMP_DIR/dogfood-accounts.tsv" 2>/dev/null || stat -f '%Lp' "$TMP_DIR/dogfood-accounts.tsv")"
[ "$mode" = '600' ] || fail "凭据文件权限不是 600：$mode"
for log_file in "$TMP_DIR/first.log" "$TMP_DIR/second.log" "$TMP_DIR/recover-one.log" "$TMP_DIR/remote.log"; do
  grep -q 'PROVISION_PASS accounts=40 creators=10 role_mismatches=0 claimed_accounts=40 duplicate_claims=0 FREE=12' "$log_file" \
    || fail "缺少终验通过证据：$log_file"
  ! grep -q 'test-seed-must-not-appear' "$log_file" || fail "日志泄漏 seed"
  ! grep -q 'admin-password-must-not-appear' "$log_file" || fail "日志泄漏 admin 密码"
  ! grep -q 'bootstrap-token-from-file\|fake-admin-token\|fakeAccessToken\|fakeRefreshToken\|fake-mysql-password' "$log_file" || \
    fail "日志泄漏 token 或数据库密码"
done

# 持久清理清单只能保存数据库主键和不可逆摘要，不能保存 bearer 明文。
cleanup_manifest="$TMP_DIR/dogfood-accounts.tsv.runtime-cleanup.tsv"
rg -q '^schema dogfood-provision-cleanup/2$' "$cleanup_manifest" || fail "清理清单未升级为主键撤销 schema"
rg -q '^oauth [0-9]+ [0-9]+ [0-9a-f]{64} [0-9a-f]{64}$' "$cleanup_manifest" || \
  fail "清理清单缺 OAuth 数据库主键与摘要"
! rg -q 'fakeAccessToken|fakeRefreshToken|oauth2_access_token:' "$cleanup_manifest" || \
  fail "持久清理清单仍保存 bearer 或带 bearer 的 Redis key"

# 手工场景仍可显式使用用户名密码；不能与 token 文件混用。
rm -f "$TMP_DIR/manual-requests.log"
mv "$TMP_DIR/requests.log" "$TMP_DIR/token-requests.log"
: >"$TMP_DIR/requests.log"
PROVISION_ACK='PROVISION_DOGFOOD_40_USERS_WITH_TEMP_CONFIG' \
  DOGFOOD_PASSWORD_SEED='test-seed-must-not-appear' ADMIN_USERNAME='admin' \
  DOGFOOD_PROVISION_RUN_ID='dogfood-test-run-001' \
  DOGFOOD_PROVISION_CAPABILITY='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' \
  ADMIN_PASSWORD='admin-password-must-not-appear' BASE="http://127.0.0.1:$PORT" \
  MYSQL_BIN="$TMP_DIR/mysql" MYSQL_PASSWORD='fake-mysql-password' MYSQL_SSH_HOST='' \
  DOGFOOD_FAKE_STATE="$TMP_DIR/state.json" DOGFOOD_ACCOUNTS_FILE="$TMP_DIR/manual-accounts.tsv" \
  VERIFY_TIMEOUT_SEC=2 PATH="$TMP_DIR:$PATH" "$SCRIPT" >"$TMP_DIR/manual.log" 2>&1
rg -q '^POST /admin-api/system/auth/login$' "$TMP_DIR/requests.log" || fail "手工账号密码模式未登录 admin"

# token 文件必须是 0600 普通文件，且两种认证来源不能同时提供。
chmod 644 "$TMP_DIR/bootstrap-admin.token"
if PROVISION_ACK='PROVISION_DOGFOOD_40_USERS_WITH_TEMP_CONFIG' DOGFOOD_PASSWORD_SEED=x \
    ADMIN_TOKEN_FILE="$TMP_DIR/bootstrap-admin.token" BASE="http://127.0.0.1:$PORT" \
    "$SCRIPT" >"$TMP_DIR/wide-token.log" 2>&1; then
  fail "权限过宽的 ADMIN_TOKEN_FILE 未被拒绝"
fi
chmod 600 "$TMP_DIR/bootstrap-admin.token"
ln -s "$TMP_DIR/bootstrap-admin.token" "$TMP_DIR/bootstrap-admin-link.token"
if PROVISION_ACK='PROVISION_DOGFOOD_40_USERS_WITH_TEMP_CONFIG' DOGFOOD_PASSWORD_SEED=x \
    ADMIN_TOKEN_FILE="$TMP_DIR/bootstrap-admin-link.token" BASE="http://127.0.0.1:$PORT" \
    "$SCRIPT" >"$TMP_DIR/symlink-token.log" 2>&1; then
  fail "symlink ADMIN_TOKEN_FILE 未被拒绝"
fi
if PROVISION_ACK='PROVISION_DOGFOOD_40_USERS_WITH_TEMP_CONFIG' DOGFOOD_PASSWORD_SEED=x \
    ADMIN_TOKEN_FILE="$TMP_DIR/bootstrap-admin.token" ADMIN_USERNAME=admin ADMIN_PASSWORD=secret \
    BASE="http://127.0.0.1:$PORT" "$SCRIPT" >"$TMP_DIR/mixed-auth.log" 2>&1; then
  fail "token 文件与用户名密码混用未被拒绝"
fi

# 数据库缺失查询若返回本次 40 人之外的编号，脚本必须在请求后端前拒绝，防止越权消耗额度。
DOGFOOD_FAKE_MISSING_MODE=rogue run_provision "$TMP_DIR/rogue-missing-id.log" '' fail
rg -q '不属于本次 40 个目标账号' "$TMP_DIR/rogue-missing-id.log" || fail "未拒绝越界补偿 userId"

# 重复 claim 属数据不变量破坏，不能通过补偿接口掩盖。
DOGFOOD_FAKE_COUNTS_MODE=duplicate run_provision "$TMP_DIR/duplicate-claims.log" '' fail
rg -q 'duplicate_claims=1' "$TMP_DIR/duplicate-claims.log" || fail "未报告重复 claim"

# 危险边界必须在任何网络请求前拒绝。
if PROVISION_ACK='wrong' DOGFOOD_PASSWORD_SEED=x ADMIN_TOKEN_FILE="$TMP_DIR/bootstrap-admin.token" \
    BASE="http://127.0.0.1:$PORT" "$SCRIPT" >"$TMP_DIR/bad-ack.log" 2>&1; then
  fail "错误 ACK 未被拒绝"
fi
if PROVISION_ACK='PROVISION_DOGFOOD_40_USERS_WITH_TEMP_CONFIG' DOGFOOD_PASSWORD_SEED=x \
    ADMIN_TOKEN_FILE="$TMP_DIR/bootstrap-admin.token" BASE='http://localhost:48080' \
    "$SCRIPT" >"$TMP_DIR/bad-base.log" 2>&1; then
  fail "非法 BASE host 未被拒绝"
fi

# 失败补偿先按主键+摘要事务删除 MySQL access/refresh 记录，再清四个限流桶与 access token 缓存。
cat >"$TMP_DIR/redis-cli" <<'SH'
#!/usr/bin/env bash
set -euo pipefail
[ "${REDISCLI_AUTH:-}" = 'fake-redis-password' ]
if [ "$*" = '-h 127.0.0.1 -p 16379 -n 0 --scan --pattern oauth2_access_token:*' ]; then
  printf 'oauth2_access_token:accessToken0123456789abcdef\n'
  printf 'oauth2_access_token:refreshToken0123456789abcdef\n'
  exit 0
fi
[ "$*" = '-h 127.0.0.1 -p 16379 -n 0 -x DEL' ]
key="$(cat)"
printf '%s\n' "$key" >>"$DOGFOOD_FAKE_REDIS_DELETES"
printf '1\n'
SH
chmod +x "$TMP_DIR/redis-cli"
cat >"$TMP_DIR/mysql-cleanup" <<'SH'
#!/usr/bin/env bash
set -euo pipefail
sql="$(cat)"
printf '%s\n' "$sql" >"$DOGFOOD_FAKE_CLEANUP_SQL"
[[ "$sql" == *'DELETE a FROM system_oauth2_access_token'* ]]
[[ "$sql" == *'DELETE r FROM system_oauth2_refresh_token'* ]]
[[ "$sql" == *"CONCAT('PAIR\\t'"* ]]
[[ "$sql" == *"CONCAT('VALID_PAIRS\\t'"* ]]
[[ "$sql" == *"CONCAT('REMAINING\\t'"* ]]
case "${DOGFOOD_FAKE_DB_STATE:-present}" in
  present)
    printf 'TARGET\t1\nPAIR\t101\t601\t1\t1\t1\t1\nVALID_PAIRS\t1\nREVOKED\t1\t1\nREMAINING\t0\t0\n'
    ;;
  both-missing)
    printf 'TARGET\t1\nPAIR\t101\t601\t0\t0\t0\t0\nVALID_PAIRS\t1\nREVOKED\t0\t0\nREMAINING\t0\t0\n'
    ;;
  access-only)
    printf 'TARGET\t1\nPAIR\t101\t601\t1\t1\t0\t0\nVALID_PAIRS\t0\nREVOKED\t0\t0\nREMAINING\t1\t0\n'
    ;;
  refresh-only)
    printf 'TARGET\t1\nPAIR\t101\t601\t0\t0\t1\t1\nVALID_PAIRS\t0\nREVOKED\t0\t0\nREMAINING\t0\t1\n'
    ;;
  access-hash-drift)
    printf 'TARGET\t1\nPAIR\t101\t601\t1\t0\t1\t1\nVALID_PAIRS\t0\nREVOKED\t0\t0\nREMAINING\t1\t1\n'
    ;;
  refresh-hash-drift)
    printf 'TARGET\t1\nPAIR\t101\t601\t1\t1\t1\t0\nVALID_PAIRS\t0\nREVOKED\t0\t0\nREMAINING\t1\t1\n'
    ;;
  valid-count-drift)
    printf 'TARGET\t1\nPAIR\t101\t601\t1\t1\t1\t1\nVALID_PAIRS\t0\nREVOKED\t0\t0\nREMAINING\t1\t1\n'
    ;;
  residual-after-delete)
    printf 'TARGET\t1\nPAIR\t101\t601\t1\t1\t1\t1\nVALID_PAIRS\t1\nREVOKED\t1\t1\nREMAINING\t1\t0\n'
    ;;
  target-count-drift)
    printf 'TARGET\t2\nPAIR\t101\t601\t1\t1\t1\t1\nVALID_PAIRS\t1\nREVOKED\t1\t1\nREMAINING\t0\t0\n'
    ;;
  *) exit 2 ;;
esac
SH
chmod +x "$TMP_DIR/mysql-cleanup"
ACCESS_TOKEN_HASH="$(printf 'accessToken0123456789abcdef' | shasum -a 256 | awk '{print $1}')"
REFRESH_TOKEN_HASH="$(printf 'refreshToken0123456789abcdef' | shasum -a 256 | awk '{print $1}')"
cat >"$TMP_DIR/runtime-cleanup.tsv" <<EOF
schema dogfood-provision-cleanup/2
run_id cleanup-run-001
key passport_ip:register:hour:127.0.0.1:2026072312
key passport_ip:register:day:127.0.0.1:20260723
key passport_ip:login:hour:127.0.0.1:2026072312
key passport_ip:login:day:127.0.0.1:20260723
oauth 101 601 $ACCESS_TOKEN_HASH $REFRESH_TOKEN_HASH
EOF
chmod 600 "$TMP_DIR/runtime-cleanup.tsv"
REDIS_PASSWORD='fake-redis-password' REDIS_CLI_BIN="$TMP_DIR/redis-cli" \
  MYSQL_BIN="$TMP_DIR/mysql-cleanup" MYSQL_PASSWORD='fake-mysql-password' MYSQL_SSH_HOST='' \
  DOGFOOD_FAKE_CLEANUP_SQL="$TMP_DIR/mysql-cleanup.sql" \
  DOGFOOD_FAKE_REDIS_DELETES="$TMP_DIR/redis-deletes.log" \
  "$SCRIPT" --cleanup "$TMP_DIR/runtime-cleanup.tsv" cleanup-run-001 \
  >"$TMP_DIR/runtime-cleanup.log"
[ "$(sort -u "$TMP_DIR/redis-deletes.log" | wc -l | tr -d ' ')" = 6 ] || \
  fail "运行态补偿未精确删除 4 个限流桶与 2 个 token key"
[ ! -e "$TMP_DIR/runtime-cleanup.tsv" ] || fail "补偿成功后未删除敏感清单"
rg -q '^DOGFOOD_RUNTIME_CLEANUP_PASS run_id=cleanup-run-001 oauth=1 keys=6$' \
  "$TMP_DIR/runtime-cleanup.log" || fail "运行态补偿缺可审计结果"
! rg -q 'accessToken0123456789abcdef|refreshToken0123456789abcdef' \
  "$TMP_DIR/runtime-cleanup.log" || fail "运行态补偿日志泄漏 token"

# 单侧缺失和任一摘要漂移都必须停在 Redis 之前，并保留清单供人工复核。
for db_state in access-only refresh-only access-hash-drift refresh-hash-drift valid-count-drift residual-after-delete; do
  manifest="$TMP_DIR/${db_state}-runtime-cleanup.tsv"
  redis_log="$TMP_DIR/${db_state}-redis-deletes.log"
  cleanup_log="$TMP_DIR/${db_state}-runtime-cleanup.log"
  cat >"$manifest" <<EOF
schema dogfood-provision-cleanup/2
run_id cleanup-run-$db_state
key passport_ip:login:day:127.0.0.1:20260723
oauth 101 601 $ACCESS_TOKEN_HASH $REFRESH_TOKEN_HASH
EOF
  chmod 600 "$manifest"
  : >"$redis_log"
  if REDIS_PASSWORD='fake-redis-password' REDIS_CLI_BIN="$TMP_DIR/redis-cli" \
      MYSQL_BIN="$TMP_DIR/mysql-cleanup" MYSQL_PASSWORD='fake-mysql-password' MYSQL_SSH_HOST='' \
      DOGFOOD_FAKE_DB_STATE="$db_state" DOGFOOD_FAKE_CLEANUP_SQL="$TMP_DIR/mysql-cleanup-${db_state}.sql" \
      DOGFOOD_FAKE_REDIS_DELETES="$redis_log" \
      "$SCRIPT" --cleanup "$manifest" "cleanup-run-$db_state" >"$cleanup_log" 2>&1; then
    fail "OAuth 非法数据库状态仍被判为成功：$db_state"
  fi
  [ -e "$manifest" ] || fail "OAuth 状态校验失败后错误删除清理清单：$db_state"
  [ ! -s "$redis_log" ] || fail "OAuth 状态校验失败后仍清理了 Redis：$db_state"
  rg -q 'OAuth MySQL 撤销状态非法' "$cleanup_log" || fail "OAuth 非法状态缺少可追踪拒因：$db_state"
done

# SQL 自报的 TARGET 必须与清单目标数完全一致。
target_manifest="$TMP_DIR/target-count-drift-runtime-cleanup.tsv"
cat >"$target_manifest" <<EOF
schema dogfood-provision-cleanup/2
run_id cleanup-run-target-count-drift
oauth 101 601 $ACCESS_TOKEN_HASH $REFRESH_TOKEN_HASH
EOF
chmod 600 "$target_manifest"
if REDIS_PASSWORD='fake-redis-password' REDIS_CLI_BIN="$TMP_DIR/redis-cli" \
    MYSQL_BIN="$TMP_DIR/mysql-cleanup" MYSQL_PASSWORD='fake-mysql-password' MYSQL_SSH_HOST='' \
    DOGFOOD_FAKE_DB_STATE='target-count-drift' DOGFOOD_FAKE_CLEANUP_SQL="$TMP_DIR/mysql-cleanup-target-count-drift.sql" \
    DOGFOOD_FAKE_REDIS_DELETES="$TMP_DIR/target-count-drift-redis.log" \
    "$SCRIPT" --cleanup "$target_manifest" cleanup-run-target-count-drift \
    >"$TMP_DIR/target-count-drift.log" 2>&1; then
  fail "OAuth TARGET 漂移仍被判为成功"
fi
rg -q 'OAuth MySQL 撤销目标不匹配' "$TMP_DIR/target-count-drift.log" || \
  fail "OAuth TARGET 漂移缺少可追踪拒因"

# 数据库记录已成对撤销时，重试仍须用摘要定位并清掉遗留 Redis 缓存。
cat >"$TMP_DIR/retry-runtime-cleanup.tsv" <<EOF
schema dogfood-provision-cleanup/2
run_id cleanup-run-retry
oauth 101 601 $ACCESS_TOKEN_HASH $REFRESH_TOKEN_HASH
EOF
chmod 600 "$TMP_DIR/retry-runtime-cleanup.tsv"
: >"$TMP_DIR/retry-redis-deletes.log"
REDIS_PASSWORD='fake-redis-password' REDIS_CLI_BIN="$TMP_DIR/redis-cli" \
  MYSQL_BIN="$TMP_DIR/mysql-cleanup" MYSQL_PASSWORD='fake-mysql-password' MYSQL_SSH_HOST='' \
  DOGFOOD_FAKE_DB_STATE='both-missing' DOGFOOD_FAKE_CLEANUP_SQL="$TMP_DIR/mysql-cleanup-retry.sql" \
  DOGFOOD_FAKE_REDIS_DELETES="$TMP_DIR/retry-redis-deletes.log" \
  "$SCRIPT" --cleanup "$TMP_DIR/retry-runtime-cleanup.tsv" cleanup-run-retry \
  >"$TMP_DIR/retry-runtime-cleanup.log"
[ "$(sort -u "$TMP_DIR/retry-redis-deletes.log" | wc -l | tr -d ' ')" = 2 ] || \
  fail "MySQL 已撤销后的重试未按摘要清理 Redis"
rg -q '^DOGFOOD_RUNTIME_CLEANUP_PASS run_id=cleanup-run-retry oauth=1 keys=2$' \
  "$TMP_DIR/retry-runtime-cleanup.log" || fail "幂等 OAuth 清理缺少可审计结果"

# 预检阶段尚无 Redis 副作用时，只有 schema/run-id 的清单应幂等收口为 keys=0。
cat >"$TMP_DIR/empty-runtime-cleanup.tsv" <<'EOF'
schema dogfood-provision-cleanup/2
run_id cleanup-run-empty
EOF
chmod 600 "$TMP_DIR/empty-runtime-cleanup.tsv"
REDIS_PASSWORD='fake-redis-password' REDIS_CLI_BIN="$TMP_DIR/redis-cli" \
  MYSQL_BIN="$TMP_DIR/mysql-cleanup" MYSQL_PASSWORD='fake-mysql-password' MYSQL_SSH_HOST='' \
  DOGFOOD_FAKE_CLEANUP_SQL="$TMP_DIR/mysql-cleanup-empty.sql" \
  DOGFOOD_FAKE_REDIS_DELETES="$TMP_DIR/redis-deletes.log" \
  "$SCRIPT" --cleanup "$TMP_DIR/empty-runtime-cleanup.tsv" cleanup-run-empty \
  >"$TMP_DIR/empty-runtime-cleanup.log"
[ ! -e "$TMP_DIR/empty-runtime-cleanup.tsv" ] || fail "空运行态清理清单未幂等删除"
rg -q '^DOGFOOD_RUNTIME_CLEANUP_PASS run_id=cleanup-run-empty oauth=0 keys=0$' \
  "$TMP_DIR/empty-runtime-cleanup.log" || fail "空运行态清理清单未幂等收口"

printf 'TEST_PASS provision-dogfood-users 缺失 claim 补偿、运行态清理、40/40 单 claim、越权拒绝、幂等与脱敏校验通过\n'