#!/usr/bin/env bash
set -euo pipefail

source_root=${1:-}
[[ -n ${source_root} ]] || {
  echo "usage: test-jd-language-primary-target-contract.sh <guanghu-os-source>" >&2
  exit 64
}

target=${source_root}/packaging/systemd/guanghu-language-primary.target
world_gate_unit=${source_root}/packaging/systemd/guanghu-world-gate.service
acceptance_unit=${source_root}/packaging/systemd/guanghu-boot-acceptance.service
world_gate=${source_root}/scripts/verify-jd-language-primary-world.sh
acceptance=${source_root}/scripts/verify-jd-language-primary-acceptance.sh
installer=${source_root}/scripts/install-jd-language-primary-target.sh

for path in \
  "${target}" \
  "${world_gate_unit}" \
  "${acceptance_unit}" \
  "${world_gate}" \
  "${acceptance}" \
  "${installer}"; do
  test -f "${path}"
done

grep -Fxq 'Requires=multi-user.target' "${target}"
grep -Fq 'guanghu-world-gate.service' "${target}"
grep -Fq 'guanghu-boot-acceptance.service' "${target}"
grep -Fq 'bingshuo-tcs-living-controller.service' "${target}"
grep -Fq 'guanghu-ai-discovery.service' "${target}"
grep -Fq 'lake-lamp-authz.service' "${target}"
grep -Fq 'lake-lamp-architecture-provision.service' "${target}"
grep -Fq 'lake-lamp-deployment-event-worker.service' "${target}"
grep -Fxq 'AllowIsolate=yes' "${target}"

grep -Fxq 'Type=oneshot' "${world_gate_unit}"
grep -Fxq 'RemainAfterExit=yes' "${world_gate_unit}"
grep -Fq 'Before=bingshuo-tcs-living-controller.service' "${world_gate_unit}"
grep -Fq '/usr/local/libexec/guanghu-os/verify-jd-language-primary-world' \
  "${world_gate_unit}"

grep -Fxq 'Type=oneshot' "${acceptance_unit}"
grep -Fxq 'RemainAfterExit=yes' "${acceptance_unit}"
grep -Fq 'After=guanghu-world-gate.service' "${acceptance_unit}"
grep -Fq '/usr/local/libexec/guanghu-os/verify-jd-language-primary-acceptance' \
  "${acceptance_unit}"
grep -Fq 'ReadWritePaths=/var/lib/guanghu/language-primary/receipts' \
  "${acceptance_unit}"

grep -Fq '/guanghu/bin/ghctl wake /guanghu/current' "${world_gate}"
grep -Fq '/guanghu/bin/ghctl authorize /guanghu/current run_tests_and_health_checks' \
  "${world_gate}"
grep -Fq 'caa7b1019517470f9d1368b6e79db49e' "${world_gate}"
grep -Fq 'f3d4b730-7f02-452f-975b-7091a4800431' "${world_gate}"

for service in \
  bingshuo-tcs-living-controller.service \
  guanghu-ai-discovery.service \
  lake-lamp-authz.service \
  lake-lamp-architecture-provision.service \
  lake-lamp-deployment-event-worker.service; do
  grep -Fq "${service}" "${acceptance}"
done
grep -Fq 'https://guanghulab.com/code/' "${acceptance}"
grep -Fq 'https://guanghulab.com/api/ai/v1/anchor' "${acceptance}"
grep -Fq '"phase" == "RUNNING_COMPANION"' "${acceptance}"
grep -Fq '.execution_substrate.state == "PASS_100"' "${acceptance}"
grep -Fq '.execution_substrate.linux_role == "COOPERATIVE_EXECUTION_SUBSTRATE"' \
  "${acceptance}"
grep -Fq '.execution_substrate.arbitrary_shell == false' "${acceptance}"
! grep -Fq '."execution_substrate.state"' "${acceptance}"
grep -Fq 'boot_changed: false' "${acceptance}"

grep -Fq 'install_world_version' "${installer}"
grep -Fq '.guanghu-source-commit' "${installer}"
grep -Fq 'systemctl start guanghu-language-primary.target' "${installer}"
grep -Fq 'systemctl set-default guanghu-language-primary.target' "${installer}"
grep -Fq 'systemctl set-default "${previous_default}"' "${installer}"
grep -Fq 'rollback' "${installer}"

if grep -Eiq 'eval|sh -c|bash -c|rm -rf /|systemctl reboot|grub-reboot' \
  "${world_gate}" "${acceptance}" "${installer}"; then
  echo "language-primary path contains a forbidden unbounded execution primitive" >&2
  exit 1
fi

for script in "${world_gate}" "${acceptance}" "${installer}"; do
  bash -n "${script}"
done

echo "JD_LANGUAGE_PRIMARY_TARGET_CONTRACT_PASS_100"