#!/usr/bin/env bash
# test-verify-clean-clone.sh -- needles for the verifier itself.
#
# v1 of the verifier passed while the real repository recorded 100644, because it
# asserted a SCRATCH repo built by cp. There was no needle that could have caught
# that: every case ran against a tree whose modes came off my filesystem.
# So the load-bearing needle here is w2 -- SOURCE GIT MODE 100644, DISK MODE 755.
# That is the exact contaminated state, and v1 exits 0 on it while v2 must refuse.
# A verifier without this needle is the same shape as the defect it verifies.

set -uo pipefail

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
VERIFY="$HERE/verify-clean-clone.sh"
ARTIFACTS=(push-guard.sh test-push-guard.sh verify-clean-clone.sh mutate-push-guard.sh
           test-mutate-push-guard.sh
           test-verify-clean-clone.sh)

# THE REAL DEPLOYED LAYOUT. Every fixture in the first version of this file
# installed the artifacts at the fixture ROOT, so 6/6 green proved flat-layout
# operation and said NOTHING about the path these files actually ship at. The
# verifier was unusable in place and the suite could not see it, because THE
# FIXTURE ENCODED A LAYOUT THAT DOES NOT EXIST. A fixture is a claim about the
# world; an untested fixture is an unreviewed one.
readonly REAL_PREFIX="packages/mosaic/framework/tools/git"

PASS=0; FAIL=0
TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

# Build a source repo whose COMMITTED modes are 100755 and whose disk modes are
# executable -- the honest state.
# mkrepo <repo-root> [subdir]
# With a subdir the artifacts are committed at repo/<subdir>/, which is how they
# really ship. Echoes the directory the artifacts landed in -- that is what gets
# passed as --repo, so the caller never has to reconstruct the path.
mkrepo() {
    local d="$1" sub="${2:-}"
    local dest="$d${sub:+/$sub}"
    mkdir -p "$dest"
    local f
    for f in "${ARTIFACTS[@]}"; do
        install -m 755 "$HERE/$f" "$dest/$f"
    done
    git -C "$d" init -q .
    git -C "$d" config user.email "v@example.invalid"
    git -C "$d" config user.name "Verifier Needles"
    git -C "$d" add -A
    git -C "$d" commit -q -m "artifacts"
    printf '%s\n' "$dest"
}

run_case() {
    local name="$1" want_rc="$2" want_txt="$3" repo="$4"
    local out rc
    out="$("$VERIFY" --repo "$repo" 2>&1)"; rc=$?
    if (( rc == want_rc )) && [[ "$out" == *"$want_txt"* ]]; then
        printf '  ok    [%-14s]\n' "$name"; PASS=$(( PASS + 1 ))
    else
        printf '  FAIL  [%-14s] wanted rc=%d containing %q; got rc=%d\n%s\n' \
            "$name" "$want_rc" "$want_txt" "$rc" "$out"; FAIL=$(( FAIL + 1 ))
    fi
}

echo "== POSITIVE CONTROL: an honestly-committed artifact must PASS =="
# Without this, every case below could be passing because the verifier always
# refuses -- a wall, not a gate.
mkrepo "$TMP/good" >/dev/null
run_case w1-honest 0 "the COMMITTED artifact ran and passed" "$TMP/good"

echo
echo "== THE DEPLOYED LAYOUT: artifacts NESTED, not at the repository root =="
# The blocker: ls-tree was given a bare basename, which is a ROOT-relative
# pathspec, so in the real tree every artifact came back NOT TRACKED and the
# verifier refused to run at all. This control fails against that version and
# passes only when the committed PREFIX is threaded through ls-tree, the cloned
# stat, and the suite's working directory.
w6dir="$(mkrepo "$TMP/nested" "$REAL_PREFIX")"
run_case w6-nested 0 "the COMMITTED artifact ran and passed" "$w6dir"
# ...and prove the run actually happened DOWN THERE rather than at the root, or
# a passing w6 would only mean the prefix was ignored harmlessly.
#
# Captured into a variable rather than piped into `grep -q` ON PURPOSE. grep -q
# exits at the FIRST match, the verifier then dies of SIGPIPE, and under
# `pipefail` the pipeline reports that 141 -- so A SUCCESSFUL MATCH READS AS A
# FAILED ASSERTION. This cost me a red w6-prefix against a verifier that was
# printing the right prefix all along. Same family as the pipefail/process-
# substitution note already on record: the exit status being consulted is not
# the status of the thing being asserted.
w6out="$("$VERIFY" --repo "$w6dir" 2>&1)"
if [[ "$w6out" == *"prefix $REAL_PREFIX/"* ]]; then
    printf '  ok    [%-14s] verifier reported prefix %s/\n' "w6-prefix" "$REAL_PREFIX"; PASS=$(( PASS + 1 ))
else
    printf '  FAIL  [%-14s] verifier did not report the nested prefix -- it may have\n' "w6-prefix"
    printf '        passed by looking at the root, which is the blocker unfixed\n'; FAIL=$(( FAIL + 1 ))
fi
# And the mode needle must ALSO bite in the nested layout: a prefix threaded
# into the clone but not into ls-tree would silently stop checking modes.
w7dir="$(mkrepo "$TMP/nested-laundered" "$REAL_PREFIX")"
git -C "$TMP/nested-laundered" update-index --chmod=-x "$REAL_PREFIX/push-guard.sh"
git -C "$TMP/nested-laundered" commit -q -m "drop exec bit in git only"
run_case w7-nested-mode 1 "committed 100644, needs 100755" "$w7dir"

echo
echo "== THE B1 NEEDLE: source git mode 100644, DISK MODE STILL 755 =="
# This is the reviewer's exact reproduction. v1 of the verifier exits 0 here.
mkrepo "$TMP/laundered" >/dev/null
git -C "$TMP/laundered" update-index --chmod=-x push-guard.sh test-push-guard.sh
git -C "$TMP/laundered" commit -q -m "drop exec bit in git only"
# PROVE THE FIXTURE IS THE CONTAMINATED STATE, not merely a broken repo: git must
# say 100644 while the filesystem still says executable. If the disk bit were
# gone too, the needle would be testing something easier than the real defect.
src_mode="$(git -C "$TMP/laundered" ls-tree HEAD -- push-guard.sh | awk '{print $1}')"
disk_mode="$(stat -c '%a' "$TMP/laundered/push-guard.sh")"
if [[ "$src_mode" == "100644" && "$disk_mode" == "755" ]]; then
    printf '  ok    [%-14s] fixture is git=%s disk=%s\n' "w2-fixture" "$src_mode" "$disk_mode"; PASS=$(( PASS + 1 ))
else
    printf '  FAIL  [%-14s] fixture wrong: git=%s disk=%s -- needle would not test the defect\n' \
        "w2-fixture" "$src_mode" "$disk_mode"; FAIL=$(( FAIL + 1 ))
fi
run_case w2-laundered 1 "committed 100644, needs 100755" "$TMP/laundered"

echo
echo "== the artifact must be COMMITTED, or there is no mode to verify =="
mkrepo "$TMP/untracked" >/dev/null
git -C "$TMP/untracked" rm -q --cached push-guard.sh
git -C "$TMP/untracked" commit -q -m "untrack the guard"
run_case w3-untracked 1 "NOT TRACKED" "$TMP/untracked"

echo
echo "== a committed SYMLINK is a path, not the reviewed code =="
mkrepo "$TMP/symlink" >/dev/null
( cd "$TMP/symlink" && rm -f push-guard.sh && ln -s /dev/null push-guard.sh \
  && git add push-guard.sh && git commit -q -m "symlink the guard" )
run_case w4-symlink 1 "SYMLINK" "$TMP/symlink"

echo
echo "== not a repository at all: REFUSE, never pass =="
mkdir -p "$TMP/bare"
for f in "${ARTIFACTS[@]}"; do install -m 755 "$HERE/$f" "$TMP/bare/$f"; done
run_case w5-norepo 1 "not inside a git repository" "$TMP/bare"

echo
printf '%d passed, %d failed\n' "$PASS" "$FAIL"
(( FAIL == 0 ))