#!/usr/bin/env bash

set -Eeuo pipefail

TEST_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"
test_dir="$(mktemp -d)"
trap 'rm -rf "$test_dir"' EXIT
deployment="${test_dir}/deployment"
mock_bin="${test_dir}/bin"
mkdir -p "$deployment" "$mock_bin"
cp -R \
	"${TEST_ROOT}/install.sh" \
	"${TEST_ROOT}/manage.sh" \
	"${TEST_ROOT}/compose.yaml" \
	"${TEST_ROOT}/compose.http.yaml" \
	"${TEST_ROOT}/compose.tls.yaml" \
	"${TEST_ROOT}/compose.direct.yaml" \
	"${TEST_ROOT}/deploy" \
	"$deployment/"

mv "${deployment}/deploy/nginx/templates/http.conf.template" \
	"${deployment}/deploy/nginx/templates/http.conf.template.saved"
mkdir "${deployment}/deploy/nginx/templates/http.conf.template"
if (
	cd "$deployment"
	printf '%s\n' \
		'broker.test' \
		'git.test' \
		'8780' \
		'8743' \
		'' |
		./install.sh >/dev/null 2>&1
); then
	printf 'FAIL: installer accepted a template path that was a directory\n' >&2
	exit 1
fi
rmdir "${deployment}/deploy/nginx/templates/http.conf.template"
mv "${deployment}/deploy/nginx/templates/http.conf.template.saved" \
	"${deployment}/deploy/nginx/templates/http.conf.template"

cat >"${mock_bin}/docker" <<'MOCK'
#!/usr/bin/env bash
printf '%s\n' "$*" >>"$MOCK_DOCKER_LOG"
case "$*" in
"compose version" | "info" | "network inspect tapm-edge")
	exit 0
	;;
esac
exit 0
MOCK
chmod +x "${mock_bin}/docker"
export MOCK_DOCKER_LOG="${test_dir}/docker.log"
export PATH="${mock_bin}:${PATH}"

if grep -R '^[[:space:]]*keepalive_timeout[[:space:]]' \
	"${TEST_ROOT}/deploy/nginx/templates/"*.template >/dev/null; then
	printf 'FAIL: conf.d template duplicates nginx.conf keepalive_timeout\n' >&2
	exit 1
fi
grep -F -- './config/letsencrypt/archive:/etc/archive:ro' \
	"${TEST_ROOT}/compose.tls.yaml" >/dev/null || {
	printf 'FAIL: TLS compose does not expose Certbot archive symlink targets\n' >&2
	exit 1
}

printf '%s\n' \
	'broker.test' \
	'git.test' \
	'8780' \
	'8743' \
	'' |
	"${deployment}/install.sh" >/dev/null

assert_env() {
	local expected="$1"
	grep -Fx "$expected" "${deployment}/.env" >/dev/null || {
		printf 'FAIL: missing environment line: %s\n' "$expected" >&2
		exit 1
	}
}

assert_env 'SSL_MODE=none'
assert_env 'TAPM_PUBLIC_URL=http://broker.test:8780'
assert_env 'TAPM_GITEA_URL=http://git.test:8780'
assert_env 'TAPM_GITEA_INTERNAL_URL=http://gitea:3000'
assert_env 'GITEA_PUBLIC_URL=http://git.test:8780/'
assert_env 'TAPM_DEFAULT_DURATION=7d'
grep -F -- '-f compose.yaml -f compose.http.yaml up -d gitea nginx' \
	"$MOCK_DOCKER_LOG" >/dev/null || {
	printf 'FAIL: HTTP bootstrap did not select compose.http.yaml\n' >&2
	exit 1
}
if stat -c '%a' "${deployment}/.env" >/dev/null 2>&1; then
	env_mode="$(stat -c '%a' "${deployment}/.env")"
else
	env_mode="$(stat -f '%Lp' "${deployment}/.env")"
fi
[[ "$env_mode" == 600 ]] || {
	printf 'FAIL: .env mode is %s, want 600\n' "$env_mode" >&2
	exit 1
}

if "${deployment}/manage.sh" start >/dev/null 2>&1; then
	printf 'FAIL: broker started without Git credentials\n' >&2
	exit 1
fi

printf '%s\n' 'admin@example.test' |
	"${deployment}/manage.sh" set-ssl letsencrypt >/dev/null
assert_env 'SSL_MODE=letsencrypt'
assert_env 'TAPM_PUBLIC_URL=https://broker.test'
assert_env 'GITEA_PUBLIC_URL=https://git.test/'

"${deployment}/manage.sh" set-ssl none >/dev/null
assert_env 'SSL_MODE=none'
assert_env 'TAPM_PUBLIC_URL=http://broker.test:8780'

"${deployment}/manage.sh" rotate-cookie-secret >/dev/null
rotated_secret="$(
	sed -n 's/^TAPM_COOKIE_SECRET=//p' "${deployment}/.env"
)"
(( ${#rotated_secret} >= 32 )) || {
	printf 'FAIL: cookie secret rotation produced a short value\n' >&2
	exit 1
}

printf 'PASS: guided HTTP deployment and TLS transition\n'