#!/usr/bin/env bash
# tests/preflight/run-tests.sh -- offline harness for preflight.sh (DOCFIX-073).
# Builds a fixture repo whose gate scripts are stubs with controlled exits, plus
# a fakebin juju for the channel assert. Asserts ordering, aggregation (worst of
# 0/1/2), and fail-closed behavior on a missing gate. Mutates nothing outside $TMP.
# Exit: 0 all pass | 1 any case failed.  ASCII + LF.
set -uo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO="$(cd "$HERE/../.." && pwd)"
TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
PASS=0; FAIL=0

mkfix() { # mkfix <name> <lint_rc> <bundlechk_rc> <preflight_present:0|1> [creds_rc|"omit"]
  local d="$TMP/$1"; mkdir -p "$d/scripts" "$d/fakebin"
  cp "$REPO/scripts/preflight.sh" "$REPO/scripts/channel_assert.py" "$d/scripts/"
  printf 'applications:\n  keystone: {charm: keystone, channel: 2024.1/stable}\n' > "$d/bundle.yaml"
  printf '#!/usr/bin/env bash\necho "  [stub] lint"\nexit %s\n' "$2" > "$d/scripts/repo-lint.sh"
  printf '#!/usr/bin/env python3\nimport sys;print("  [stub] bundlechk");sys.exit(%s)\n' "$3" > "$d/scripts/provider-bundle-check.py"
  if [ "$4" = "1" ]; then
    # The stub REPORTS the DC it was handed. F5 (2026-07-29): preflight used to set DC
    # without exporting it, so whether P4 saw the same DC as P2 depended on the caller's
    # invocation form. The stub is how a child's view becomes observable to the harness.
    printf '#!/usr/bin/env bash\necho "  [stub] live preflight CHILD_DC=${DC:-<unset>}"\nexit 0\n' \
      > "$d/scripts/pre-flight-checks.sh"
  fi
  # P5 credential matrix (D-137 ruling 1). "omit" leaves the gate script absent so the
  # fail-closed path can be exercised.
  if [ "${5:-0}" != "omit" ]; then
    printf '#!/usr/bin/env python3\nimport sys;print("  [stub] creds-matrix");sys.exit(%s)\n' \
      "${5:-0}" > "$d/scripts/creds-matrix.py"
  fi
  # fakebin juju: publishes 2024.1/stable in the channel map
  cat > "$d/fakebin/juju" <<'FB'
#!/usr/bin/env bash
if [ "$1" = "info" ]; then
  printf 'name: %s\nchannels:\n  2024.1/stable: 778 2024-05-01\n' "$2"; exit 0
fi
exit 1
FB
  chmod +x "$d/fakebin/juju"
  echo "$d"
}
run() { # run <want_rc> <regex> <label> <dir> [DC]
  # No [DC] means a genuinely BARE invocation: `env -u DC` so an inherited DC in the
  # harness's own environment cannot make the default path look like it works.
  local out rc
  if [ -n "${5:-}" ]; then
    out="$(PATH="$4/fakebin:$PATH" DC="$5" bash "$4/scripts/preflight.sh" "$4" 2>&1)"; rc=$?
  else
    out="$(PATH="$4/fakebin:$PATH" env -u DC bash "$4/scripts/preflight.sh" "$4" 2>&1)"; rc=$?
  fi
  if [[ "$rc" == "$1" ]] && grep -qE "$2" <<<"$out"; then
    echo "  PASS  $3"; PASS=$((PASS+1))
  else
    echo "  FAIL  $3 (rc=$rc want=$1)"; echo "$out" | tail -6 | sed 's/^/        /'; FAIL=$((FAIL+1))
  fi
}

D=$(mkfix all_pass 0 0 1);   run 0 'PREFLIGHT: PASS' "T1 all gates pass -> PASS" "$D"
D=$(mkfix lint_fail 1 0 1);  run 1 'PREFLIGHT: FAIL' "T2 lint FAIL -> overall FAIL" "$D"
D=$(mkfix bundle_fail 0 1 1); run 1 'PREFLIGHT: FAIL' "T3 bundle FAIL -> overall FAIL" "$D"
D=$(mkfix warn_only 2 0 1);  run 2 'PREFLIGHT: WARN' "T4 lint WARN -> overall WARN" "$D"
D=$(mkfix missing_gate 0 0 0); run 1 'pre-flight-checks.sh missing' "T5 missing gate FAILS CLOSED" "$D"
# T6: channel pinned to a track fakebin does not publish -> FAIL
D=$(mkfix badpin 0 0 1); printf 'applications:\n  vault: {charm: vault, channel: 9.9/stable}\n' > "$D/bundle.yaml"
run 1 'does not publish' "T6 unpublished channel pin FAILS" "$D"
# T7: charmhub unreachable -> WARN (exit 2), not FAIL.
# HERMETIC: simulate failure with a FAILING fake, never by deleting the fake --
# deletion un-shadows the REAL juju on a real host (the jumphost gauntlet run
# fell through to live charmhub and returned 0). Fakes must always shadow.
D=$(mkfix offline 0 0 1)
cat > "$D/fakebin/juju" <<'FB'
#!/usr/bin/env bash
echo "ERROR cannot connect to charmhub.io: connection timed out" >&2; exit 1
FB
chmod +x "$D/fakebin/juju"
run 2 'verify .* manually' "T7 charmhub unreachable -> WARN" "$D"

# T8 -- D-137 ruling 1: the credential gate is BLOCKING. A red register must stop a
# deploy, not warn about it -- advisory was the posture that demonstrably failed.
D=$(mkfix creds_fail 0 0 1 1); run 1 'PREFLIGHT: FAIL' "T8 credential matrix FAIL -> overall FAIL" "$D"
# T9 -- the credential gate must FAIL CLOSED if its checker is missing, exactly as T5
# requires of pre-flight-checks.sh. A gate that vanishes must never read as a pass.
D=$(mkfix creds_gone 0 0 1 omit); run 1 'PREFLIGHT: FAIL' "T9 credential gate missing -> FAILS CLOSED" "$D"
# T10 -- ordering: the credential gate runs with the REAL gates, before the stage-2
# reminders block, so its verdict participates in the deploy decision.
D=$(mkfix creds_order 0 0 1 0)
out="$(PATH="$D/fakebin:$PATH" bash "$D/scripts/preflight.sh" "$D" 2>&1)"
if [[ "$(grep -n 'P5: credential matrix' <<<"$out" | cut -d: -f1)" -lt \
      "$(grep -n 'P6: stage-2 reminders' <<<"$out" | cut -d: -f1)" ]]; then
  echo "  PASS  T10 credential gate runs BEFORE the reminders block"; PASS=$((PASS+1))
else
  echo "  FAIL  T10 credential gate ordering"; FAIL=$((FAIL+1))
fi

# ---- T11-T16 -- R15(3): PREFLIGHT MUST NOT FAIL OPEN (ruled 2026-07-27) ----
# MEASURED DEFECT: note() tested only rc 1 and 2, so a sub-gate exiting 127/126/130
# or any rc>=3 left WORST untouched and preflight printed
#   "PREFLIGHT: PASS -- clear to add-model / deploy"
# Reproduced for all four before the fix. This is the gate that AUTHORISES the deploy.
run 1 'PREFLIGHT: FAIL' "T11 R15(3) sub-gate exit 127 (command not found) -> FAIL, was PASS" "$(mkfix rc127 127 0 1 0)"
run 1 'PREFLIGHT: FAIL' "T12 R15(3) sub-gate exit 126 (not executable) -> FAIL, was PASS" "$(mkfix rc126 0 126 1 0)"
run 1 'PREFLIGHT: FAIL' "T13 R15(3) sub-gate exit 3 (undefined) -> FAIL, was PASS" "$(mkfix rc3 0 0 1 3)"

# rc=2 is PER-GATE and was measured per checker rather than blanket-remapped.
# P2/P5 rc2 means "could not evaluate" -> FAIL. A gate that could not look must never
# read as a gate that found nothing.
run 1 'COULD NOT EVALUATE' "T14 R15(3) P2 rc=2 (could-not-evaluate) -> FAIL" "$(mkfix p2two 0 2 1 0)"
run 1 'COULD NOT EVALUATE' "T15 R15(3) P5 rc=2 (could-not-evaluate) -> FAIL" "$(mkfix p5two 0 0 1 2)"

# P1 rc2 is "warnings only" by its own documented contract. It must STAY a warning --
# a blanket 2->FAIL would have turned the standing L1 legacy-ASCII warn into a deploy
# blocker. This case is the regression lock on NOT over-correcting.
run 2 'PREFLIGHT: WARN' "T16 R15(3) P1 rc=2 (warnings only) stays WARN, not FAIL" "$(mkfix p1two 2 0 1 0)"

# ---- T17-T24 -- F5: ONE DC selection, EXPORTED, VALIDATED and PRINTED --------------
# MEASURED DEFECT (docs/audit/stage5-findings-20260729-successor.md F5): preflight.sh:99
# set DC="${DC:-vr1-dc0}" and never exported it, so `DC=vr1-dc1 bash scripts/preflight.sh`
# put it in the environment (children saw it) while a BARE invocation did not (children
# saw nothing and silently used their own default). Two call shapes, two behaviours.
D=$(mkfix dc_export 0 0 1 0)
run 0 'CHILD_DC=vr1-dc0' "T17 F5 BARE invocation EXPORTS the default DC to the sub-gates" "$D"
run 0 'CHILD_DC=vr1-dc1' "T18 F5 DC=vr1-dc1 reaches the sub-gates" "$D" vr1-dc1
# The verdict must say which DC it describes -- one combined verdict line over two DCs
# was the reader-facing half of F5.
run 0 'PREFLIGHT: PASS \(DC=vr1-dc1\)' "T19 F5 the verdict line names the DC" "$D" vr1-dc1
run 0 'PREFLIGHT TARGET: DC=vr1-dc1' "T20 F5 the opening header names the DC" "$D" vr1-dc1
# The `PREFLIGHT: <verdict>` token stays CONTIGUOUS -- T1-T16 above grep it verbatim and
# so do the runbooks. This pins that the DC was APPENDED, not interpolated into it.
run 2 'PREFLIGHT: WARN \(DC=vr1-dc0\)' "T21 F5 the verdict token is not split by the DC" "$(mkfix dc_warn 2 0 1 0)"
# REFUSE an unrecognised DC rather than gating an unknown target.
run 1 'not a recognised datacenter selector' "T22 F5 an unknown DC token REFUSES" "$D" no-such-dc
run 1 'RETIRED \(D-119\)' "T23 F5 a bare 'dc1' is rejected as RETIRED" "$D" dc1
# ... and refusing must happen BEFORE any gate runs: a rejected DC that still executed
# P1..P5 would have measured something and called it nothing.
OUT_BAD="$(PATH="$D/fakebin:$PATH" DC=no-such-dc bash "$D/scripts/preflight.sh" "$D" 2>&1)"
if grep -q 'P1: repo lint' <<<"$OUT_BAD"; then
  echo "  FAIL  T24 an unknown DC must refuse BEFORE any gate runs"; FAIL=$((FAIL+1))
else
  echo "  PASS  T24 an unknown DC refuses BEFORE any gate runs"; PASS=$((PASS+1))
fi

# ---- T25 -- F1: P2 assembles the PER-DC octavia-pki overlay -------------------------
# The loop hardcoded `overlays/octavia-pki.yaml`, a single unscoped path for what the
# D-109 R7 amendment rules must be per-DC CA material. Each overlay is added only when
# present, so the assertion is on the NAME P2 announces, not on a secret existing.
D=$(mkfix dc_ovl 0 0 1 0); mkdir -p "$D/overlays"
: > "$D/overlays/vr1-dc1-octavia-pki.yaml"
run 0 'overlay overlays/vr1-dc1-octavia-pki.yaml' "T25 F1 P2 picks up the PER-DC octavia-pki overlay" "$D" vr1-dc1
if PATH="$D/fakebin:$PATH" DC=vr1-dc1 bash "$D/scripts/preflight.sh" "$D" 2>&1 \
   | grep -qE 'overlay overlays/octavia-pki\.yaml'; then
  echo "  FAIL  T26 the old unscoped octavia-pki name must be gone"; FAIL=$((FAIL+1))
else
  echo "  PASS  T26 the old unscoped octavia-pki overlay name is gone"; PASS=$((PASS+1))
fi

echo; echo "RESULT: PASS=$PASS FAIL=$FAIL"
[[ "$FAIL" -eq 0 ]] && { echo "ALL PASS"; exit 0; } || exit 1