#!/usr/lib64/linuxfabrik-monitoring-plugins/venv/bin/python
# -*- coding: utf-8; py-indent-offset: 4 -*-
#
# Author:  Linuxfabrik GmbH, Zurich, Switzerland
# Contact: info (at) linuxfabrik (dot) ch
#          https://www.linuxfabrik.ch/
# License: The Unlicense, see LICENSE file.

# https://github.com/Linuxfabrik/monitoring-plugins/blob/main/CONTRIBUTING.md

"""See the check's README for more details."""

import argparse
import json
import re
import sys

import lib.args
import lib.base
import lib.huawei_dorado
import lib.human
import lib.lftest
import lib.time
import lib.txt
from lib.globals import STATE_CRIT, STATE_OK, STATE_UNKNOWN, STATE_WARN

__author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
__version__ = '2026081103'

DESCRIPTION = """Checks the health and running status of all HyperMetro pairs on a Huawei OceanStor
Dorado storage system via the REST API (/hypermetropair endpoint). Alerts when any
pair reports a non-normal state or synchronization issue.
Supports extended reporting via --lengthy."""

DEFAULT_BRIEF = False
DEFAULT_CACHE_EXPIRE = 15  # minutes; default session timeout period is 20 minutes
DEFAULT_DEVICE_ID = ''  # the appliance reports its own at login
DEFAULT_INSECURE = True
DEFAULT_NO_MATCH_SEVERITY = 'ok'
DEFAULT_NO_PROXY = False
DEFAULT_SCOPE = '0'
DEFAULT_TIMEOUT = 3

# `LINKSTATUS` of a pair whose two sides can reach each other, and the readable form of
# both documented codes. A pair that is not connected is not mirroring.
CONNECTED = 1
LINK_STATUS = {
    1: 'Connected (1)',
    2: 'Disconnected (2)',
}
LINK_STATUS_MAX = 2

# `LOCALDATASTATE` and `REMOTEDATASTATE` of a side whose data matches the other one, and
# the readable form of both documented codes.
CONSISTENT = 1
DATA_STATE = {
    1: 'Consistent (1)',
    2: 'Inconsistent (2)',
}
DATA_STATE_MAX = 2

# Highest `HEALTHSTATUS` code the REST Interface References document (offline). It
# bounds the metric so a graph scales to the whole enumeration; the thresholds stay
# out of the performance data, because whether a code is a fault depends on the
# object and is decided in `lib.huawei_dorado.get_health_status_state()`.
HEALTH_STATUS_MAX = 18

# Highest `SECRESACCESS` code the REST Interface References document (read/write). Both
# the local and the remote side use the same enumeration, so both metrics carry the same
# maximum.
HOST_ACCESS_STATE_MAX = 3

# Fields `--match` is applied to.
MATCH_FIELDS = ('UUID', 'LOCALOBJNAME', 'REMOTEOBJNAME')

# RUNNINGSTATUS codes a healthy HyperMetro pair reports: normal (1) and
# synchronizing (23). A pair that is still catching up is doing what it should.
OK_RUNNING_STATUS = (1, 23)


def parse_args():
    """Parse command line arguments using argparse."""
    parser = argparse.ArgumentParser(
        description=DESCRIPTION,
        epilog=lib.args.epilog(__file__),
        formatter_class=lib.args.HelpFormatter,
    )

    parser.add_argument(
        '-V',
        '--version',
        action='version',
        version=f'%(prog)s: v{__version__} by {__author__}',
    )

    parser.add_argument(
        '--always-ok',
        help=lib.args.help('--always-ok'),
        dest='ALWAYS_OK',
        action='store_true',
        default=False,
    )

    parser.add_argument(
        '--brief',
        help=lib.args.help('--brief')
        + ' Worth setting on an array with many HyperMetro pairs. '
        'Default: %(default)s',
        dest='BRIEF',
        action='store_true',
        default=DEFAULT_BRIEF,
    )

    parser.add_argument(
        '--cache-expire',
        help=lib.args.help('--cache-expire') + ' Default: %(default)s',
        dest='CACHE_EXPIRE',
        type=int,
        default=DEFAULT_CACHE_EXPIRE,
    )

    parser.add_argument(
        '--device-id',
        help='Huawei OceanStor Dorado API device ID. '
        'Optional: the appliance reports its own at login, so this is only '
        'needed to override that answer.',
        dest='DEVICE_ID',
        default=DEFAULT_DEVICE_ID,
    )

    parser.add_argument(
        '--ignore',
        help='Skip HyperMetro pairs. '
        + lib.args.help('--ignore-regex')
        + ' The regex is anchored at the start of the string (Python `re.match`) and is '
        'matched against `UUID`, `LOCALOBJNAME`, `REMOTEOBJNAME`, so prefix with `.*` to match anywhere.',
        dest='IGNORE',
        action='append',
        default=None,
    )

    parser.add_argument(
        '--insecure',
        help=lib.args.help('--insecure'),
        dest='INSECURE',
        action='store_true',
        default=DEFAULT_INSECURE,
    )

    parser.add_argument(
        '--lengthy',
        help=lib.args.help('--lengthy'),
        dest='LENGTHY',
        action='store_true',
        default=False,
    )

    parser.add_argument(
        '--no-insecure',
        help=lib.args.help('--no-insecure'),
        dest='INSECURE',
        action='store_false',
        default=DEFAULT_INSECURE,
    )

    parser.add_argument(
        '--match',
        help='Limit to HyperMetro pairs. '
        + lib.args.help('--match')
        + ' The regex is anchored at the start of the string (Python `re.match`) and is '
        'matched against `UUID`, `LOCALOBJNAME`, `REMOTEOBJNAME`, so prefix with `.*` to match anywhere.',
        dest='MATCH',
        action='append',
        default=None,
    )

    parser.add_argument(
        '--no-match-severity',
        help=lib.args.help('--no-match-severity') + ' Default: %(default)s',
        dest='NO_MATCH_SEVERITY',
        choices=['ok', 'warn', 'crit', 'unknown'],
        default=DEFAULT_NO_MATCH_SEVERITY,
    )

    parser.add_argument(
        '--no-perfdata',
        help=lib.args.help('--no-perfdata'),
        dest='NO_PERFDATA',
        action='store_true',
        default=False,
    )

    parser.add_argument(
        '--no-proxy',
        help=lib.args.help('--no-proxy'),
        dest='NO_PROXY',
        action='store_true',
        default=DEFAULT_NO_PROXY,
    )

    parser.add_argument(
        '--password',
        help='Huawei OceanStor Dorado API password.',
        dest='PASSWORD',
    )

    parser.add_argument(
        '--password-file',
        help=lib.args.help('--password-file'),
        dest='PASSWORD_FILE',
    )

    parser.add_argument(
        '--scope',
        help='Huawei OceanStor Dorado API scope.',
        dest='SCOPE',
        default=DEFAULT_SCOPE,
    )

    parser.add_argument(
        '--test',
        help=lib.args.help('--test'),
        dest='TEST',
        type=lib.args.csv,
    )

    parser.add_argument(
        '--timeout',
        help=lib.args.help('--timeout') + ' Default: %(default)s (seconds)',
        dest='TIMEOUT',
        type=int,
        default=DEFAULT_TIMEOUT,
    )

    parser.add_argument(
        '-u',
        '--url',
        help='Huawei OceanStor Dorado API URL.',
        dest='URL',
        required=True,
    )

    parser.add_argument(
        '--username',
        help='Huawei OceanStor Dorado API username.',
        dest='USERNAME',
        required=True,
    )

    parser.add_argument(
        '-v',
        '--verbose',
        help=lib.args.help('--verbose')
        + ' Appends what every API request returned, so the appliance\'s own answers '
        'can be read while working out how it reports something. Session tokens are '
        'redacted. The output is as long as those answers are, so this is a debugging '
        'aid rather than something to leave switched on.',
        dest='VERBOSE',
        action='store_true',
        default=False,
    )

    args, _ = parser.parse_known_args()
    return args


def as_timestamp(value):
    """Return a synchronization timestamp, or `None` where the pair reports none.

    The REST Interface Reference documents `-1` for a pair that has never
    synchronized, and firmware in the field also answers with `0` or leaves the field
    out entirely. All three mean the same thing and must not reach `epoch2iso()`.
    """
    code = lib.huawei_dorado.as_code(value)
    if code is None or code <= 0:
        return None
    return code


def main():
    """The main function. This is where the magic happens."""

    # parse the command line
    try:
        args = parse_args()
    except SystemExit:
        sys.exit(STATE_UNKNOWN)

    if args.PASSWORD_FILE:
        args.PASSWORD = lib.args.load_secret(args.PASSWORD_FILE)
    if not args.PASSWORD:
        lib.base.cu('Provide the API password via --password or --password-file.')

    # set default values for append parameters that were not specified
    if args.IGNORE is None:
        args.IGNORE = []
    if args.MATCH is None:
        args.MATCH = []

    if not args.URL.startswith('http'):
        lib.base.cu('--url parameter has to start with "http://" or https://".')

    # fetch data
    truncated = False
    if args.TEST is None:
        result, truncated = lib.huawei_dorado.get_all_data('hypermetropair', args)
    else:
        # do not call the command, put in test data
        stdout, _stderr, _retc = lib.lftest.test(args.TEST)
        result = json.loads(stdout)

    # no valuable result?
    lib.huawei_dorado.assert_ok(result, 'the HyperMetro pairs')

    # init some vars
    msg = ''
    state = STATE_OK
    perfdata = ''
    compiled_match_regex = [
        lib.base.coe(item) for item in lib.txt.compile_regex(args.MATCH, '--match')
    ]
    compiled_ignore_regex = [
        lib.base.coe(item)
        for item in lib.txt.compile_regex(args.IGNORE, '--ignore')
    ]

    # analyze data
    table_data = []
    for hypermetropair in result.get('data') or []:
        hypermetropair['UUID'] = lib.huawei_dorado.get_uuid(hypermetropair)
        # Perfdata labels carry the object's own TYPE:ID, which stays the same
        # when hardware is moved between slots, unlike its location.
        label = re.sub(r'\W+', '_', hypermetropair['UUID'])

        if args.MATCH and not any(
            lib.base.coe(lib.txt.match_regex(pattern, str(hypermetropair.get(field, ''))))
            for pattern in compiled_match_regex
            for field in MATCH_FIELDS
        ):
            continue

        if args.IGNORE and any(
            lib.base.coe(lib.txt.match_regex(pattern, str(hypermetropair.get(field, ''))))
            for pattern in compiled_ignore_regex
            for field in MATCH_FIELDS
        ):
            continue

        health_state = lib.huawei_dorado.get_health_status_state(
            hypermetropair.get('HEALTHSTATUS')
        )
        state = lib.base.get_worst(state, health_state)

        running_state = lib.huawei_dorado.get_running_status_state(
            hypermetropair.get('RUNNINGSTATUS'), OK_RUNNING_STATUS
        )
        state = lib.base.get_worst(state, running_state)

        # Compared as a number, not as the string the appliance happens to send today:
        # a firmware answering with an integer 1 would otherwise turn three healthy
        # pairs into three warnings.
        linkstatus_state = STATE_OK
        if lib.huawei_dorado.as_code(hypermetropair.get('LINKSTATUS')) != CONNECTED:
            linkstatus_state = STATE_WARN
            state = lib.base.get_worst(state, linkstatus_state)

        localdata_state = STATE_OK
        if lib.huawei_dorado.as_code(hypermetropair.get('LOCALDATASTATE')) != CONSISTENT:
            localdata_state = STATE_WARN
            state = lib.base.get_worst(state, localdata_state)

        remotedata_state = STATE_OK
        if (
            lib.huawei_dorado.as_code(hypermetropair.get('REMOTEDATASTATE'))
            != CONSISTENT
        ):
            remotedata_state = STATE_WARN
            state = lib.base.get_worst(state, remotedata_state)

        # A pair that has never finished a synchronization reports `-1` as its end time,
        # and a firmware that leaves the field out or sends `0` means the same thing. Any
        # of those has to stay `None`: read as an epoch, they render as 1970 and turn the
        # duration into a large negative number.
        end_time = as_timestamp(hypermetropair.get('ENDTIME'))
        start_time = as_timestamp(hypermetropair.get('STARTTIME'))
        sync_duration = (
            None if end_time is None or start_time is None else end_time - start_time
        )

        perfdata += lib.base.get_perfdata(
            f'{label}_health_status',
            hypermetropair.get('HEALTHSTATUS'),
            uom=None,
            _min=0,
            _max=HEALTH_STATUS_MAX,
        )
        perfdata += lib.base.get_perfdata(
            f'{label}_running_status',
            hypermetropair.get('RUNNINGSTATUS'),
            _min=0,
        )
        perfdata += lib.base.get_perfdata(
            f'{label}_link_status',
            hypermetropair.get('LINKSTATUS'),
            uom=None,
            _min=0,
            _max=LINK_STATUS_MAX,
        )
        perfdata += lib.base.get_perfdata(
            f'{label}_local_data_state',
            hypermetropair.get('LOCALDATASTATE'),
            uom=None,
            _min=0,
            _max=DATA_STATE_MAX,
        )
        perfdata += lib.base.get_perfdata(
            f'{label}_local_host_access_state',
            hypermetropair.get('LOCALHOSTACCESSSTATE'),
            uom=None,
            _min=0,
            _max=HOST_ACCESS_STATE_MAX,
        )
        perfdata += lib.base.get_perfdata(
            f'{label}_remote_data_state',
            hypermetropair.get('REMOTEDATASTATE'),
            uom=None,
            _min=0,
            _max=DATA_STATE_MAX,
        )
        perfdata += lib.base.get_perfdata(
            f'{label}_remote_host_access_state',
            hypermetropair.get('REMOTEHOSTACCESSSTATE'),
            uom=None,
            _min=0,
            _max=HOST_ACCESS_STATE_MAX,
        )
        # `-1` on a pair that has never synchronized. Graphing it would put a point
        # below the metric's own minimum, so the pair simply reports no progress.
        sync_progress = lib.huawei_dorado.as_code(hypermetropair.get('SYNCPROGRESS'))
        if sync_progress is not None and sync_progress >= 0:
            perfdata += lib.base.get_perfdata(
                f'{label}_sync_progress',
                sync_progress,
                uom='%',
                _min=0,
                _max=100,
            )

        hypermetropair['row_state'] = lib.base.get_worst(
            lib.base.get_worst(health_state, running_state),
            lib.base.get_worst(
                linkstatus_state,
                lib.base.get_worst(localdata_state, remotedata_state),
            ),
        )
        hypermetropair['health'] = lib.huawei_dorado.get_health_status(hypermetropair.get('HEALTHSTATUS'))
        # One state per row, in the last column. IcingaWeb replaces a state with an
        # icon, which shifts everything to the right of it, so a second one mid-row
        # would break the table.
        hypermetropair['running'] = lib.huawei_dorado.get_running_status(hypermetropair.get('RUNNINGSTATUS'))
        hypermetropair['state'] = lib.base.state2str(hypermetropair['row_state'], empty_ok=False)
        hypermetropair['sync_duration'] = (
            '--' if sync_duration is None else lib.human.seconds2human(sync_duration)
        )
        if sync_progress is None or sync_progress < 0:
            # `-1` in a percent column reads as a broken value rather than as
            # "there is nothing to report yet".
            hypermetropair['SYNCPROGRESS'] = '--'
        if end_time is None:
            hypermetropair['sync_last'] = 'never'
        else:
            ago = lib.time.now(as_type='epoch') - end_time
            hypermetropair['sync_last'] = (
                f'{lib.time.epoch2iso(end_time)}'
                f' ({lib.human.seconds2human(ago)} ago)'
            )
        # The appliance's own code stays in the table. Overwriting it with the check's
        # verdict used to make "disconnected" and "invalid" read the same.
        hypermetropair['link'] = (
            f'{LINK_STATUS.get(lib.huawei_dorado.as_code(hypermetropair.get("LINKSTATUS")), "Unknown")}'
            f'{lib.base.state2str(linkstatus_state, prefix=" ")}'
        )
        hypermetropair['local_data'] = (
            f'{DATA_STATE.get(lib.huawei_dorado.as_code(hypermetropair.get("LOCALDATASTATE")), "Unknown")}'
            f'{lib.base.state2str(localdata_state, prefix=" ")}'
        )
        hypermetropair['remote_data'] = (
            f'{DATA_STATE.get(lib.huawei_dorado.as_code(hypermetropair.get("REMOTEDATASTATE")), "Unknown")}'
            f'{lib.base.state2str(remotedata_state, prefix=" ")}'
        )
        hypermetropair['LOCALHOSTACCESSSTATE'] = (
            lib.huawei_dorado.get_host_access_state(
                hypermetropair.get('LOCALHOSTACCESSSTATE')
            )
        )
        hypermetropair['REMOTEHOSTACCESSSTATE'] = (
            lib.huawei_dorado.get_host_access_state(
                hypermetropair.get('REMOTEHOSTACCESSSTATE')
            )
        )

        table_data.append(hypermetropair)

    # An appliance may legitimately have no HyperMetro pairs configured, which is not
    # the same as a filter that selected none of the ones it does have.
    if not table_data:
        lib.base.oao(
            f'No HyperMetro pairs matched `{", ".join(args.MATCH)}`.'
            if args.MATCH
            else 'No HyperMetro pairs configured.',
            lib.base.str2state(args.NO_MATCH_SEVERITY) if args.MATCH else STATE_OK,
            always_ok=args.ALWAYS_OK,
            no_perfdata=args.NO_PERFDATA,
        )

    # The truncated walk raises the state before the summary is written, so a
    # partially read appliance does not open with "Everything is ok." and then exit
    # WARNING.
    if truncated:
        state = lib.base.get_worst(state, STATE_WARN)

    # build the message
    if state == STATE_CRIT:
        msg += 'There are critical errors.'
    elif state == STATE_WARN:
        msg += 'There are warnings.'
    else:
        msg += 'Everything is ok.'
    msg += '\n'
    if truncated:
        # The walk hit its page cap, so pairs beyond it were never looked at.
        msg += (
            'The appliance reports more HyperMetro pairs than this check reads in'
            ' one run; the list below is incomplete.\n'
        )
    msg += '\n'

    # build table output
    display_rows = table_data
    if args.BRIEF:
        display_rows = [row for row in table_data if row['row_state'] != STATE_OK]
    if display_rows:
        if args.LENGTHY:
            keys = [
                'UUID',
                'sync_last',
                'sync_duration',
                'SYNCPROGRESS',
                'LOCALOBJNAME',
                'LOCALHOSTACCESSSTATE',
                'REMOTEOBJNAME',
                'REMOTEHOSTACCESSSTATE',
                'link',
                'local_data',
                'remote_data',
                'health',
                'running',
                'state',
            ]
            headers = [
                'UUID',
                'Last Sync',
                'Duration',
                'Progr (%)',
                'LocalJob',
                'Access',
                'RemoteJob',
                'Access',
                'Link',
                'Local Data',
                'Remote Data',
                'Health',
                'Running',
                'State',
            ]
        else:
            keys = [
                'UUID',
                'sync_last',
                'SYNCPROGRESS',
                'LOCALOBJNAME',
                'REMOTEOBJNAME',
                'link',
                'health',
                'running',
                'state',
            ]
            headers = [
                'UUID',
                'Last Sync',
                'Progr (%)',
                'LocalJob',
                'RemoteJob',
                'Link',
                'Health',
                'Running',
                'State',
            ]

        msg += lib.base.get_table(
            display_rows, keys, header=headers, missing='--', hide_empty=True
        )

    if args.VERBOSE:
        msg += '\n\n' + lib.huawei_dorado.format_responses()

    # over and out
    lib.base.oao(
        msg, state, perfdata, always_ok=args.ALWAYS_OK, no_perfdata=args.NO_PERFDATA
    )


if __name__ == '__main__':
    try:
        main()
    except Exception:
        lib.base.cu()
