#!/usr/bin/env bash
# tests/netem-sudoers/run-tests.sh -- guard for scripts/sudoers.d/netem-tc
# (step-E scoped NOPASSWD, operator-ruled 2026-07-21). Static confinement
# assertions: only tc, only the two ruled verbs, only measured mesh bridges,
# no broadening (ALL, shells, wildcards outside netem args). visudo syntax
# check when available. Exit: 0 all pass | 1 any failed. ASCII + LF.
set -uo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
FRAG="$(cd "$HERE/../.." && pwd)/scripts/sudoers.d/netem-tc"
PASS=0; FAIL=0
ok(){ echo "  PASS  $1"; PASS=$((PASS+1)); }
no(){ echo "  FAIL  $1"; FAIL=$((FAIL+1)); }

[ -f "$FRAG" ] && ok "T1 fragment present" || { no "T1 fragment present"; echo; echo "netem-sudoers: $PASS passed, 1 failed"; exit 1; }

RULES="$(grep -v '^#' "$FRAG" | grep -v '^[[:space:]]*$')"

# T2: every rule line is a NOPASSWD tc rule for the operator user -- nothing else
BAD="$(grep -vcE '^jessea123 ALL=\(root\) NOPASSWD: /usr/sbin/tc qdisc (replace|del) dev virbr[0-9]+ root( netem \*)?$' <<<"$RULES")"
[ "$BAD" -eq 0 ] && ok "T2 every rule matches the ruled tc shape exactly" \
  || no "T2 every rule matches the ruled tc shape exactly ($BAD stray line(s))"

# T3: exactly 6 rules -- replace+del per measured mesh bridge (5,7,3)
N="$(wc -l <<<"$RULES")"
[ "$N" -eq 6 ] && ok "T3 exactly 6 rules (2 verbs x 3 mesh bridges)" \
  || no "T3 exactly 6 rules (found $N)"
for br in virbr5 virbr7 virbr3; do
  grep -q "replace dev $br root netem" <<<"$RULES" && grep -q "del dev $br root\$" <<<"$RULES" \
    && ok "T4 $br has replace+del pair" || no "T4 $br has replace+del pair"
done

# T5: no broadening tokens anywhere in active rules
grep -qE 'ALL[[:space:]]*$|/bin/|/usr/bin/|sh |bash |env ' <<<"$RULES" \
  && no "T5 no shells / blanket ALL commands" \
  || ok "T5 no shells / blanket ALL commands"

# T6: the drifting-ID caveat is documented (re-measure discipline)
grep -q 'RE-MEASURE' "$FRAG" && ok "T6 re-measure caveat documented" \
  || no "T6 re-measure caveat documented"

# T7: visudo syntax check when available (unprivileged -cf; skip cleanly)
if command -v visudo >/dev/null 2>&1; then
  if visudo -cf "$FRAG" >/dev/null 2>&1; then ok "T7 visudo -cf clean"; else no "T7 visudo -cf clean"; fi
else
  echo "  SKIP  T7 visudo not available"
fi

echo; echo "netem-sudoers: $PASS passed, $FAIL failed"
[ "$FAIL" -eq 0 ]