#!/usr/bin/env bash
# tests/dc-mirror/run-tests.sh -- guard for scripts/dc-mirror.sh (D-135 item 1:
# the per-DC apt+UCA mirror, D-107 build-out). Static: syntax, both sites'
# identity values (D-134 utility .4 + ruled edge gateways -- changing one
# silently breaks the mirror address or the sync egress), stable-identity
# keying (libvirt net names, never virbrN), GPG-verified sync (keyrings
# present in both debmirror calls, no --ignore-release-gpg), read-only check
# path, and the MEASURED-tag discipline on site rows.
# Exit: 0 all pass | 1 any case failed. ASCII + LF.
set -uo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SCRIPT="$(cd "$HERE/../.." && pwd)/scripts/dc-mirror.sh"
PASS=0; FAIL=0
ok(){ echo "  PASS  $1"; PASS=$((PASS+1)); }
no(){ echo "  FAIL  $1"; FAIL=$((FAIL+1)); }

[ -f "$SCRIPT" ] && ok "T1 script present" || { no "T1 script present"; echo; echo "dc-mirror: $PASS passed, $FAIL failed"; exit 1; }
bash -n "$SCRIPT" 2>/dev/null && ok "T2 bash -n clean" || no "T2 bash -n clean"

# T3-T4: dc0 identity values (D-134 utility .4 + ruled edge gw)
grep -q 'LISTEN_CIDR="10.12.8.4/22"' "$SCRIPT" \
  && grep -q 'MIRROR_NET="vr1-dc0-metal-admin"' "$SCRIPT" \
  && ok "T3 dc0 LISTEN 10.12.8.4/22 on metal-admin (utility .4)" \
  || no "T3 dc0 LISTEN 10.12.8.4/22 on metal-admin (utility .4)"
awk '/^  dc0\)/{f=1} f{print} f&&/;;/{exit}' "$SCRIPT" | grep -q 'EDGE_GW="10.12.4.1"' \
  && ok "T4 dc0 edge gw 10.12.4.1" || no "T4 dc0 edge gw 10.12.4.1"

# T5-T6: dc1 identity values
grep -q 'LISTEN_CIDR="10.12.68.4/22"' "$SCRIPT" \
  && grep -q 'MIRROR_NET="vr1-dc1-metal-admin"' "$SCRIPT" \
  && ok "T5 dc1 LISTEN 10.12.68.4/22 on metal-admin (utility .4)" \
  || no "T5 dc1 LISTEN 10.12.68.4/22 on metal-admin (utility .4)"
awk '/^  dc1\)/{f=1} f{print} f&&/;;/{exit}' "$SCRIPT" | grep -q 'EDGE_GW="10.12.64.1"' \
  && ok "T6 dc1 edge gw 10.12.64.1" || no "T6 dc1 edge gw 10.12.64.1"

# T7: stable-identity keying -- no virbrN literal; bridges from net names
grep -q 'net-dumpxml' "$SCRIPT" && ! grep -q 'virbr[0-9]' "$SCRIPT" \
  && ok "T7 bridges resolved from net names; no virbrN literal" \
  || no "T7 bridges resolved from net names; no virbrN literal"

# T8: both debmirror calls carry a keyring; gpg verification never disabled
KEYRING_COUNT="$(grep -c -- '--keyring=' "$SCRIPT")"
[ "$KEYRING_COUNT" -ge 2 ] && ! grep -q 'ignore-release-gpg' "$SCRIPT" \
  && ok "T8 both debmirror calls GPG-verified (no ignore-release-gpg)" \
  || no "T8 both debmirror calls GPG-verified (keyrings=$KEYRING_COUNT)"

# T9: binary-only mirror -- no sources pulled
[ "$(grep -c -- '--nosource' "$SCRIPT")" -ge 2 ] \
  && ok "T9 both mirrors --nosource (binary only)" \
  || no "T9 both mirrors --nosource (binary only)"

# T10: the ruled dist set -- jammy triple + UCA caracal
grep -q -- '--dist=jammy,jammy-updates,jammy-security' "$SCRIPT" \
  && grep -q -- '--dist=jammy-updates/caracal' "$SCRIPT" \
  && ok "T10 dists: jammy triple + UCA jammy-updates/caracal" \
  || no "T10 dists: jammy triple + UCA jammy-updates/caracal"

# T11: unknown site refuses with exit 2 and demands measured rows
OUT="$(bash "$SCRIPT" check nosuchsite 2>&1)"; RC=$?
[ "$RC" -eq 2 ] && grep -q 'MEASURED' <<<"$OUT" \
  && ok "T11 unknown site exits 2 and demands measured rows" \
  || no "T11 unknown site exits 2 and demands measured rows (rc=$RC)"

# T12: bad mode refuses
bash "$SCRIPT" frobnicate dc0 >/dev/null 2>&1; RC=$?
[ "$RC" -eq 2 ] && ok "T12 bad mode exits 2" || no "T12 bad mode exits 2 (rc=$RC)"

# T13: sync unit ordered after + requires the net unit (egress must exist)
grep -q 'After=\${SITE}-mirror-net.service' "$SCRIPT" \
  && grep -q 'Requires=\${SITE}-mirror-net.service' "$SCRIPT" \
  && ok "T13 sync unit Requires/After net unit" \
  || no "T13 sync unit Requires/After net unit"

# T14: check path never mutates
CHECK_BLOCK="$(awk '/^do_check\(\)/{f=1} f{print} f&&/^}/{exit}' "$SCRIPT")"
grep -qE 'addr (add|replace|del)|route (add|replace|del)|systemctl (enable|restart|start|disable|reload)|daemon-reload|ln -|mkdir' <<<"$CHECK_BLOCK" \
  && no "T14 do_check is read-only" \
  || ok "T14 do_check is read-only"

# T15: install requires root (non-root exits 4 before any mutation)
if [ "$(id -u)" != "0" ]; then
  bash "$SCRIPT" install dc0 >/dev/null 2>&1; RC=$?
  [ "$RC" -eq 4 ] && ok "T15 non-root install exits 4" || no "T15 non-root install exits 4 (rc=$RC)"
else
  ok "T15 skipped (running as root)"
fi

# T16: site rows carry MEASURED citations (hard rule 2)
DC0_BLOCK="$(awk '/^  dc0\)/{f=1} f{print} f&&/;;/{exit}' "$SCRIPT")"
DC1_BLOCK="$(awk '/^  dc1\)/{f=1} f{print} f&&/;;/{exit}' "$SCRIPT")"
grep -q 'MEASURED' <<<"$DC0_BLOCK" && grep -q 'MEASURED' <<<"$DC1_BLOCK" \
  && ok "T16 both site rows cite MEASURED provenance" \
  || no "T16 both site rows cite MEASURED provenance"

# T17: nginx vhost binds the LISTEN address only (not 0.0.0.0)
grep -q 'listen \${LISTEN}:80;' "$SCRIPT" \
  && ok "T17 nginx binds the utility address only" \
  || no "T17 nginx binds the utility address only"

# T18: sync is niced/idle-IO (a background job on a load-bearing rack host)
grep -q 'IOSchedulingClass=idle' "$SCRIPT" && grep -q 'Nice=10' "$SCRIPT" \
  && ok "T18 sync unit is niced + idle IO" \
  || no "T18 sync unit is niced + idle IO"

echo; echo "dc-mirror: $PASS passed, $FAIL failed"
[ "$FAIL" -eq 0 ]