#!/usr/bin/env bash
# test-verify-clean-clone.sh -- needles for the verifier itself.
#
# v1 of the verifier passed while the real repository recorded 100644, because it
# asserted a SCRATCH repo built by cp. There was no needle that could have caught
# that: every case ran against a tree whose modes came off my filesystem.
# So the load-bearing needle here is w2 -- SOURCE GIT MODE 100644, DISK MODE 755.
# That is the exact contaminated state, and v1 exits 0 on it while v2 must refuse.
# A verifier without this needle is the same shape as the defect it verifies.

set -uo pipefail

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
VERIFY="$HERE/verify-clean-clone.sh"
ARTIFACTS=(push-guard.sh test-push-guard.sh verify-clean-clone.sh mutate-push-guard.sh)

PASS=0; FAIL=0
TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT

# Build a source repo whose COMMITTED modes are 100755 and whose disk modes are
# executable -- the honest state.
mkrepo() {
    local d="$1"
    mkdir -p "$d"
    local f
    for f in "${ARTIFACTS[@]}"; do
        install -m 755 "$HERE/$f" "$d/$f"
    done
    git -C "$d" init -q .
    git -C "$d" config user.email "v@example.invalid"
    git -C "$d" config user.name "Verifier Needles"
    git -C "$d" add -A
    git -C "$d" commit -q -m "artifacts"
}

run_case() {
    local name="$1" want_rc="$2" want_txt="$3" repo="$4"
    local out rc
    out="$("$VERIFY" --repo "$repo" 2>&1)"; rc=$?
    if (( rc == want_rc )) && [[ "$out" == *"$want_txt"* ]]; then
        printf '  ok    [%-14s]\n' "$name"; PASS=$(( PASS + 1 ))
    else
        printf '  FAIL  [%-14s] wanted rc=%d containing %q; got rc=%d\n%s\n' \
            "$name" "$want_rc" "$want_txt" "$rc" "$out"; FAIL=$(( FAIL + 1 ))
    fi
}

echo "== POSITIVE CONTROL: an honestly-committed artifact must PASS =="
# Without this, every case below could be passing because the verifier always
# refuses -- a wall, not a gate.
mkrepo "$TMP/good"
run_case w1-honest 0 "the COMMITTED artifact ran and passed" "$TMP/good"

echo
echo "== THE B1 NEEDLE: source git mode 100644, DISK MODE STILL 755 =="
# This is the reviewer's exact reproduction. v1 of the verifier exits 0 here.
mkrepo "$TMP/laundered"
git -C "$TMP/laundered" update-index --chmod=-x push-guard.sh test-push-guard.sh
git -C "$TMP/laundered" commit -q -m "drop exec bit in git only"
# PROVE THE FIXTURE IS THE CONTAMINATED STATE, not merely a broken repo: git must
# say 100644 while the filesystem still says executable. If the disk bit were
# gone too, the needle would be testing something easier than the real defect.
src_mode="$(git -C "$TMP/laundered" ls-tree HEAD -- push-guard.sh | awk '{print $1}')"
disk_mode="$(stat -c '%a' "$TMP/laundered/push-guard.sh")"
if [[ "$src_mode" == "100644" && "$disk_mode" == "755" ]]; then
    printf '  ok    [%-14s] fixture is git=%s disk=%s\n' "w2-fixture" "$src_mode" "$disk_mode"; PASS=$(( PASS + 1 ))
else
    printf '  FAIL  [%-14s] fixture wrong: git=%s disk=%s -- needle would not test the defect\n' \
        "w2-fixture" "$src_mode" "$disk_mode"; FAIL=$(( FAIL + 1 ))
fi
run_case w2-laundered 1 "committed 100644, needs 100755" "$TMP/laundered"

echo
echo "== the artifact must be COMMITTED, or there is no mode to verify =="
mkrepo "$TMP/untracked"
git -C "$TMP/untracked" rm -q --cached push-guard.sh
git -C "$TMP/untracked" commit -q -m "untrack the guard"
run_case w3-untracked 1 "NOT TRACKED" "$TMP/untracked"

echo
echo "== a committed SYMLINK is a path, not the reviewed code =="
mkrepo "$TMP/symlink"
( cd "$TMP/symlink" && rm -f push-guard.sh && ln -s /dev/null push-guard.sh \
  && git add push-guard.sh && git commit -q -m "symlink the guard" )
run_case w4-symlink 1 "SYMLINK" "$TMP/symlink"

echo
echo "== not a repository at all: REFUSE, never pass =="
mkdir -p "$TMP/bare"
for f in "${ARTIFACTS[@]}"; do install -m 755 "$HERE/$f" "$TMP/bare/$f"; done
run_case w5-norepo 1 "not inside a git repository" "$TMP/bare"

echo
printf '%d passed, %d failed\n' "$PASS" "$FAIL"
(( FAIL == 0 ))