#!/usr/bin/env bash
# tests/dc-cache-proxy/run-tests.sh -- guard for scripts/dc-cache-proxy.sh
# (D-135 amendment 2026-07-24: the INTERIM per-DC apt CACHING PROXY, apt-cacher-ng,
# the DC1-unblock path). Static: syntax, both sites' identity values (the utility
# .4 the deploy expects + the ruled edge gateways -- changing one silently breaks
# the proxy address or upstream egress), stable-identity keying (libvirt net
# names, never virbrN), proxy-mode port pin, the MEASURED-tag discipline on site
# rows, arg/site validation, and that the net layer is REUSED (not re-created).
# Exit: 0 all pass | 1 any case failed. ASCII + LF.
set -uo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SCRIPT="$(cd "$HERE/../.." && pwd)/scripts/dc-cache-proxy.sh"
PASS=0; FAIL=0
ok(){ echo "  PASS  $1"; PASS=$((PASS+1)); }
no(){ echo "  FAIL  $1"; FAIL=$((FAIL+1)); }

[ -f "$SCRIPT" ] && ok "T1 script present" || { no "T1 script present"; echo; echo "dc-cache-proxy: $PASS passed, $FAIL failed"; exit 1; }
bash -n "$SCRIPT" 2>/dev/null && ok "T2 bash -n clean" || no "T2 bash -n clean"

# T3-T4: dc0 identity values (utility .4 + ruled edge gw) -- parity row
grep -q 'LISTEN_CIDR="10.12.8.4/22"' "$SCRIPT" \
  && grep -q 'UTIL_NET="vr1-dc0-metal-admin"' "$SCRIPT" \
  && ok "T3 dc0 LISTEN 10.12.8.4/22 on metal-admin (utility .4)" \
  || no "T3 dc0 LISTEN 10.12.8.4/22 on metal-admin (utility .4)"
awk '/^  dc0\)/{f=1} f{print} f&&/;;/{exit}' "$SCRIPT" | grep -q 'EDGE_GW="10.12.4.1"' \
  && ok "T4 dc0 edge gw 10.12.4.1" || no "T4 dc0 edge gw 10.12.4.1"

# T5-T6: dc1 identity values (the INTERIM cache-proxy site)
grep -q 'LISTEN_CIDR="10.12.68.4/22"' "$SCRIPT" \
  && grep -q 'UTIL_NET="vr1-dc1-metal-admin"' "$SCRIPT" \
  && ok "T5 dc1 LISTEN 10.12.68.4/22 on metal-admin (utility .4)" \
  || no "T5 dc1 LISTEN 10.12.68.4/22 on metal-admin (utility .4)"
awk '/^  dc1\)/{f=1} f{print} f&&/;;/{exit}' "$SCRIPT" | grep -q 'EDGE_GW="10.12.64.1"' \
  && ok "T6 dc1 edge gw 10.12.64.1" || no "T6 dc1 edge gw 10.12.64.1"

# T7: stable-identity keying -- no virbrN literal; bridge from the net name
grep -q 'net-dumpxml' "$SCRIPT" && ! grep -qE 'virbr[0-9]' "$SCRIPT" \
  && ok "T7 bridge resolved from net name; no virbrN literal" \
  || no "T7 bridge resolved from net name; no virbrN literal"

# T8: proxy-mode port pinned to 3142
grep -q 'PROXY_PORT="3142"' "$SCRIPT" && grep -q 'Port: ${PROXY_PORT}' "$SCRIPT" \
  && ok "T8 apt-cacher-ng port pinned 3142" || no "T8 apt-cacher-ng port pinned 3142"

# T9: consumption documented as proxy mode (apt-http-proxy), not apt-mirror
grep -q 'apt-http-proxy=http://' "$SCRIPT" \
  && ok "T9 documents proxy-mode consumption (apt-http-proxy)" \
  || no "T9 documents proxy-mode consumption (apt-http-proxy)"

# T10: behavioral smoke test covers BOTH archive and UCA through the proxy
grep -q 'archive.ubuntu.com' "$SCRIPT" && grep -q 'ubuntu-cloud.archive.canonical.com' "$SCRIPT" \
  && grep -q -- '-x "http://${LISTEN}:${PROXY_PORT}"' "$SCRIPT" \
  && ok "T10 smoke test proxies archive + UCA" || no "T10 smoke test proxies archive + UCA"

# T11: install requires root
grep -q 'install requires root' "$SCRIPT" && ok "T11 install requires root" || no "T11 install requires root"

# T12: net layer is REUSED, not re-created -- install fails loud if absent and
# points at dc-mirror.sh (the owner); no 'ip addr'/'ip route replace' writes here
grep -q 'dc-mirror.sh install' "$SCRIPT" && ! grep -qE 'ip (addr|route) (replace|add)' "$SCRIPT" \
  && ok "T12 net layer reused (no ip addr/route writes; points at dc-mirror.sh)" \
  || no "T12 net layer reused (no ip addr/route writes; points at dc-mirror.sh)"

# T13: MEASURED/RULED-tag discipline on every site row (hard rule 2)
MR="$(grep -cE 'MEASURED/RULED' "$SCRIPT")"
[ "$MR" -ge 2 ] && ok "T13 both site rows carry a MEASURED/RULED tag" \
  || no "T13 both site rows carry a MEASURED/RULED tag (found $MR)"

# T14: bad args / unknown site -> exit 2
out="$(bash "$SCRIPT" bogus dc1 2>&1)"; [ "$?" = "2" ] || out="$out RC!=2"
grep -q 'usage:' <<<"$out" && ok "T14 bad mode -> usage, exit 2" || no "T14 bad mode -> usage, exit 2"
bash "$SCRIPT" check zz >/dev/null 2>&1; [ "$?" = "2" ] \
  && ok "T15 unknown site -> exit 2" || no "T15 unknown site -> exit 2"

echo; echo "dc-cache-proxy: $PASS passed, $FAIL failed"
[ "$FAIL" -eq 0 ] && exit 0 || exit 1