#!/usr/bin/env bash
set -Eeuo pipefail

source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
adapter="${source_root}/scripts/linux-subcontrol-docker-backend.sh"
fixture=$(mktemp -d)
trap 'rm -rf "${fixture}"' EXIT

mkdir -p "${fixture}/bin" "${fixture}/state" "${fixture}/receipts"
printf '%s\n' 'f3d4b730-7f02-452f-975b-7091a4800431' >"${fixture}/dmi"
printf '%s\n' "menuentry 'Ubuntu' --id 'gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6' {" >"${fixture}/grub.cfg"
cat >"${fixture}/backend.conf" <<'EOF'
schema=guanghu.linux-subcontrol-docker-backend/v1
node_id=JD-FD-PRIMARY
instance_id=f3d4b730-7f02-452f-975b-7091a4800431
backend_id=jd-linux-on-demand
container_name=guanghu-linux-subcontrol-jd
image=docker.m.daocloud.io/library/ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
rescue_slot_id=gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6
EOF

cat >"${fixture}/bin/docker" <<'EOF'
#!/usr/bin/env bash
set -Eeuo pipefail
printf '%s\n' "$*" >>"${FAKE_DOCKER_LOG}"
case "${1:-}" in
  image)
    [[ "${2:-}" == inspect ]]
    ;;
  inspect)
    [[ -f "${FAKE_DOCKER_STATE}" ]] || exit 1
    printf '%s\n' true
    ;;
  run)
    touch "${FAKE_DOCKER_STATE}"
    printf '%s\n' fixture-container-id
    ;;
  exec)
    [[ -f "${FAKE_DOCKER_STATE}" ]]
    printf '%s\n' 'ID=ubuntu' 'VERSION_ID=22.04'
    ;;
  rm)
    rm -f "${FAKE_DOCKER_STATE}"
    ;;
  *)
    exit 64
    ;;
esac
EOF
chmod +x "${fixture}/bin/docker"

export GH_SUBCONTROL_TEST_MODE=1
export GH_SUBCONTROL_CONFIG="${fixture}/backend.conf"
export GH_SUBCONTROL_DOCKER="${fixture}/bin/docker"
export GH_SUBCONTROL_DMI_PATH="${fixture}/dmi"
export GH_SUBCONTROL_GRUB_CFG="${fixture}/grub.cfg"
export GH_SUBCONTROL_STATE_ROOT="${fixture}/state"
export GH_SUBCONTROL_RECEIPT_ROOT="${fixture}/receipts"
export FAKE_DOCKER_LOG="${fixture}/docker.log"
export FAKE_DOCKER_STATE="${fixture}/container.running"

[[ "$("${adapter}" observe jd-linux-on-demand)" == dormant ]]
"${adapter}" preflight jd-linux-on-demand
"${adapter}" wake jd-linux-on-demand
[[ "$("${adapter}" observe jd-linux-on-demand)" == ready ]]
"${adapter}" execute jd-linux-on-demand runtime-identity-readback REQ-001
"${adapter}" verify jd-linux-on-demand runtime-identity-readback REQ-001
"${adapter}" reclaim jd-linux-on-demand
[[ "$("${adapter}" observe jd-linux-on-demand)" == dormant ]]

grep -Fq -- '--network none' "${fixture}/docker.log"
grep -Fq -- '--read-only' "${fixture}/docker.log"
grep -Fq -- '--cap-drop ALL' "${fixture}/docker.log"
grep -Fq -- '--security-opt no-new-privileges' "${fixture}/docker.log"
grep -Fq -- '--pids-limit 64' "${fixture}/docker.log"
grep -Fq -- 'docker.m.daocloud.io/library/ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' "${fixture}/docker.log"

sed -i.bak 's#docker.m.daocloud.io/library/ubuntu@#ubuntu@#' "${fixture}/backend.conf"
"${adapter}" preflight jd-linux-on-demand
mv "${fixture}/backend.conf.bak" "${fixture}/backend.conf"

sed -i.bak 's#docker.m.daocloud.io/library/ubuntu@#unapproved.example/ubuntu@#' "${fixture}/backend.conf"
if "${adapter}" preflight jd-linux-on-demand; then
  echo "unapproved image repository was accepted" >&2
  exit 1
fi
mv "${fixture}/backend.conf.bak" "${fixture}/backend.conf"

if "${adapter}" execute jd-linux-on-demand arbitrary-shell REQ-002; then
  echo "unregistered capability was accepted" >&2
  exit 1
fi

printf '%s\n' 'wrong-instance' >"${fixture}/dmi"
if "${adapter}" wake jd-linux-on-demand; then
  echo "wrong machine identity was accepted" >&2
  exit 1
fi

printf '%s\n' 'f3d4b730-7f02-452f-975b-7091a4800431' >"${fixture}/dmi"
: >"${fixture}/grub.cfg"
if "${adapter}" wake jd-linux-on-demand; then
  echo "missing rescue slot was accepted" >&2
  exit 1
fi

printf '%s\n' 'set default="gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6"' >"${fixture}/grub.cfg"
if "${adapter}" preflight jd-linux-on-demand; then
  echo "a default reference without a rescue menuentry was accepted" >&2
  exit 1
fi

echo "GUANGHU_LINUX_SUBCONTROL_DOCKER_BACKEND_OK"