#!/bin/sh
# FIM substitute: SHA256 baseline (docs/Контроль_целостности; PMI p.24)
# Note: stand-in for afick, not a certification tool.
set -eu

REPORT="${REPORT:-/reports/fim.log}"
BASELINE="${BASELINE:-/tmp/fim-baseline.sha256}"
PATHS="/etc/nginx /usr/share/nginx/html /fim-watch"
WATCH_FILE="/fim-watch/config.snippet"

checksum() {
  find $PATHS -type f 2>/dev/null | sort | xargs sha256sum 2>/dev/null
}

: > "$REPORT"
echo "FIM checksum audit $(date -Iseconds)" >> "$REPORT"
echo "NOTE: SHA256 baseline substitute for afick on test stand only." >> "$REPORT"

checksum > "$BASELINE"
echo "Baseline created ($(wc -l < "$BASELINE") files)" >> "$REPORT"

if checksum | diff -q "$BASELINE" - > /dev/null 2>&1; then
  echo "PASS  baseline check (no changes)" >> "$REPORT"
else
  echo "FAIL  unexpected baseline diff before tamper test" >> "$REPORT"
  exit 1
fi

echo "# tamper $(date +%s)" >> "$WATCH_FILE"
if checksum | diff -q "$BASELINE" - > /dev/null 2>&1; then
  echo "FAIL  tamper not detected" >> "$REPORT"
  exit 1
else
  echo "PASS  tamper detected after file change ($WATCH_FILE)" >> "$REPORT"
fi

printf '# FIM watch file for integrity test (PMI p.24 stand-in)\n' > "$WATCH_FILE"
if checksum | diff -q "$BASELINE" - > /dev/null 2>&1; then
  echo "PASS  baseline restored after revert" >> "$REPORT"
else
  echo "WARN  baseline differs after revert (review manually)" >> "$REPORT"
fi

echo "PASS  #24 integrity control (checksum substitute for afick)" >> "$REPORT"
echo "FIM checksum complete -> $REPORT"