#!/usr/bin/env bash
set -euo pipefail

source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
test_root=$(mktemp -d)
gateway_pid=
cleanup() {
  if [[ -n ${gateway_pid} ]]; then
    kill "${gateway_pid}" 2>/dev/null || true
    wait "${gateway_pid}" 2>/dev/null || true
  fi
  rm -rf "${test_root}"
}
trap cleanup EXIT

port=$((35000 + ${BASHPID:-$$} % 1000))
state_file=${test_root}/state.json
anchor_file=${test_root}/anchor.json
code_file=${test_root}/code.json
relay_receipt=${test_root}/relay.hldp
fake_ssh=${test_root}/ssh
ssh_args=${test_root}/ssh-args.txt
ssh_config=${test_root}/ssh-config
candidate_sha=9807fa751616d4b421c103d60eecface1c5eb8013cbd89417ef9e027da281fb3
source_commit=fb1096c5ecdcfb36015d51273f487c2f36d9c9cd

cat >"${anchor_file}" <<EOF
{"schema":"guanghu.public-navigation-anchor/v1","anchor_id":"GLW-PUBLIC-NAV-ANCHOR-001","navigation_source":{"source_commit":"${source_commit}"}}
EOF
cat >"${code_file}" <<EOF
{"schema":"guanghu.native-code-channel-read-only/v1","repository_id":"REPO-012","branch":"main","commit":"${source_commit}","mode":"READ_ONLY_DISCOVERY","runtime":"GUANGHU_OS_NATIVE","full_forgejo_equivalence":false}
EOF

python3 "${source_root}/scripts/native-public-projection-gateway.py" \
  --listen-host 127.0.0.1 \
  --listen-port "${port}" \
  --state-file "${state_file}" \
  --anchor-file "${anchor_file}" \
  --code-file "${code_file}" \
  --expected-node JD-FD-PRIMARY \
  --expected-relay BS-SG-003 \
  --expected-candidate-sha256 "${candidate_sha}" \
  --expected-source-commit "${source_commit}" \
  --max-age-seconds 1 >"${test_root}/gateway.log" 2>&1 &
gateway_pid=$!

for _ in $(seq 1 50); do
  curl -fsS "http://127.0.0.1:${port}/healthz" >/dev/null 2>&1 && break
  sleep 0.05
done

[[ $(curl -sS -o "${test_root}/stale.json" -w '%{http_code}' \
  "http://127.0.0.1:${port}/api/ai/v1/anchor") == 503 ]]
grep -q '"native_projection_fresh":false' "${test_root}/stale.json"

if SSH_ORIGINAL_COMMAND="ready JD-FD-PRIMARY ${candidate_sha} ${source_commit} BS-SG-003 extra" \
  python3 "${source_root}/scripts/accept-native-public-projection.py" \
    --state-file "${state_file}" \
    --expected-node JD-FD-PRIMARY \
    --expected-relay BS-SG-003 \
    --expected-candidate-sha256 "${candidate_sha}" \
    --expected-source-commit "${source_commit}"; then
  echo "projection acceptor allowed an overlong command" >&2
  exit 1
fi

SSH_ORIGINAL_COMMAND="ready JD-FD-PRIMARY ${candidate_sha} ${source_commit} BS-SG-003" \
python3 "${source_root}/scripts/accept-native-public-projection.py" \
  --state-file "${state_file}" \
  --expected-node JD-FD-PRIMARY \
  --expected-relay BS-SG-003 \
  --expected-candidate-sha256 "${candidate_sha}" \
  --expected-source-commit "${source_commit}"

curl -fsS "http://127.0.0.1:${port}/api/ai/v1/anchor" >"${test_root}/anchor-readback.json"
curl -fsS "http://127.0.0.1:${port}/api/ai/v1/code-channel" >"${test_root}/code-readback.json"
cmp "${anchor_file}" "${test_root}/anchor-readback.json"
cmp "${code_file}" "${test_root}/code-readback.json"
[[ $(curl -sS -o /dev/null -w '%{http_code}' -X POST \
  "http://127.0.0.1:${port}/api/ai/v1/anchor") == 405 ]]

sleep 2
[[ $(curl -sS -o "${test_root}/expired.json" -w '%{http_code}' \
  "http://127.0.0.1:${port}/api/ai/v1/anchor") == 503 ]]
grep -q '"reason":"projection_expired"' "${test_root}/expired.json"

SSH_ORIGINAL_COMMAND="dormant JD-FD-PRIMARY ${candidate_sha} ${source_commit} BS-SG-003" \
python3 "${source_root}/scripts/accept-native-public-projection.py" \
  --state-file "${state_file}" \
  --expected-node JD-FD-PRIMARY \
  --expected-relay BS-SG-003 \
  --expected-candidate-sha256 "${candidate_sha}" \
  --expected-source-commit "${source_commit}"
[[ $(curl -sS -o "${test_root}/dormant.json" -w '%{http_code}' \
  "http://127.0.0.1:${port}/api/ai/v1/code-channel") == 503 ]]
grep -q '"reason":"native_not_ready"' "${test_root}/dormant.json"

cat >"${fake_ssh}" <<'EOF'
#!/usr/bin/env bash
printf '%s\n' "$*" >"${GHOS_TEST_SSH_ARGS}"
EOF
chmod 0700 "${fake_ssh}"
: >"${ssh_config}"
cat >"${relay_receipt}" <<'EOF'
schema: guanghu.physical-native-final-resident-relay/v1
status: READY_NATIVE_RESIDENT
recovery_capability_sent: false
acknowledged_sequences: 1,2,3,4,5,6
observed_nat_sources: 111.228.0.139
EOF
GHOS_TEST_SSH_ARGS=${ssh_args} python3 \
  "${source_root}/scripts/native-public-projection-relay.py" \
  --relay-receipt "${relay_receipt}" \
  --max-receipt-age-seconds 5 \
  --expected-nat-source 111.228.0.139 \
  --node JD-FD-PRIMARY \
  --relay BS-SG-003 \
  --candidate-sha256 "${candidate_sha}" \
  --source-commit "${source_commit}" \
  --ssh-bin "${fake_ssh}" \
  --ssh-config "${ssh_config}" \
  --ssh-target native-projection-gz
grep -q "native-projection-gz ready JD-FD-PRIMARY ${candidate_sha} ${source_commit} BS-SG-003$" \
  "${ssh_args}"

sed -i.bak 's/recovery_capability_sent: false/recovery_capability_sent: true/' \
  "${relay_receipt}"
GHOS_TEST_SSH_ARGS=${ssh_args} python3 \
  "${source_root}/scripts/native-public-projection-relay.py" \
  --relay-receipt "${relay_receipt}" \
  --max-receipt-age-seconds 5 \
  --expected-nat-source 111.228.0.139 \
  --node JD-FD-PRIMARY \
  --relay BS-SG-003 \
  --candidate-sha256 "${candidate_sha}" \
  --source-commit "${source_commit}" \
  --ssh-bin "${fake_ssh}" \
  --ssh-config "${ssh_config}" \
  --ssh-target native-projection-gz
grep -q "native-projection-gz dormant JD-FD-PRIMARY ${candidate_sha} ${source_commit} BS-SG-003$" \
  "${ssh_args}"

echo "NATIVE_PUBLIC_PROJECTION_TEST_PASS_100"