#!/bin/bash
# C 项：测试环境服务降权（User=root → User=pms），失败立即回滚该单元
set -e
BK=/root/sec-hardening-backup-20260920-014533
mkdir -p "$BK/units"

for u in pms-api-test pms-device-test; do
    f=/etc/systemd/system/$u.service
    [ -f "$f" ] || { echo "MISSING $f"; exit 1; }
    cp -a "$f" "$BK/units/$u.service.bak"
    sed -i 's/^User=root$/User=pms/' "$f"
    grep -q '^Group=' "$f" || sed -i 's/^User=pms$/User=pms\nGroup=pms/' "$f"
done

systemctl daemon-reload
systemctl restart pms-api-test pms-device-test
sleep 4

fail=0
for u in pms-api-test pms-device-test; do
    st=$(systemctl is-active "$u")
    pid=$(systemctl show -p MainPID --value "$u")
    usr=$(ps -o user= -p "$pid" 2>/dev/null | tr -d ' ')
    echo "$u active=$st pid=$pid user=$usr"
    [ "$st" = "active" ] || fail=1
done

if [ $fail -ne 0 ]; then
    echo "!!! 测试环境降权失败，立即回滚单元 !!!"
    for u in pms-api-test pms-device-test; do
        cp -a "$BK/units/$u.service.bak" /etc/systemd/system/$u.service
    done
    systemctl daemon-reload
    systemctl restart pms-api-test pms-device-test
    sleep 3
    echo "回滚后状态: $(systemctl is-active pms-api-test) $(systemctl is-active pms-device-test)"
    journalctl -u pms-api-test -n 25 --no-pager
    exit 1
fi

echo "=== 单元文件 User/Group ==="
grep -H 'User=\|Group=' /etc/systemd/system/pms-api-test.service /etc/systemd/system/pms-device-test.service
echo "=== 健康检查 ==="
curl -s -o /dev/null -w 'api-test /api/health -> %{http_code}\n' http://127.0.0.1:3000/api/health
curl -s http://127.0.0.1:3000/api/health; echo
echo "=== 端口 ==="
ss -ltnp | grep -E ':(3000|3001)\b'
echo "=== pms 用户写权限 ==="
su -s /bin/bash pms -c 'touch /data/pms_dev/api-server/uploads/.write-probe && echo "uploads writable" && rm -f /data/pms_dev/api-server/uploads/.write-probe'
su -s /bin/bash pms -c 'touch /data/pms_dev/api-server/exports/.write-probe && echo "exports writable" && rm -f /data/pms_dev/api-server/exports/.write-probe'
echo "=== 日志尾部 ==="
journalctl -u pms-api-test -n 8 --no-pager