#!/usr/bin/env bash
# Executable harness for setup-pnpm-install.sh (no network, no real token output).
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
HARNESS_TMP="$(mktemp -d)"
trap 'rm -rf "$HARNESS_TMP"' EXIT

fail() {
  echo "HARNESS FAIL: $*" >&2
  exit 1
}

assert_eq() {
  local label="$1" expected="$2" actual="$3"
  if [[ "$expected" != "$actual" ]]; then
    fail "$label expected '$expected' got '$actual'"
  fi
}

assert_missing() {
  local path="$1"
  if [[ -e "$path" ]]; then
    fail "expected path removed: $path"
  fi
}

assert_stderr_contains() {
  local file="$1"
  local needle="$2"
  if ! grep -Fq "$needle" "$file"; then
    fail "expected stderr to contain: $needle"
  fi
}

write_fake_tools() {
  local bin_dir="$1"
  local log_file="$2"
  mkdir -p "$bin_dir"
  cat >"$bin_dir/pnpm" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
LOG="$PNPM_HARNESS_LOG"
{
  echo "argv=$*"
  echo "userconfig=${NPM_CONFIG_USERCONFIG:-}"
} >>"$LOG"
if [[ "${PNPM_HARNESS_SHOULD_FAIL:-}" == "1" ]]; then
  exit 9
fi
if [[ "${PNPM_HARNESS_SLEEP:-}" == "1" ]]; then
  trap 'exit 130' INT
  trap 'exit 143' TERM
  while sleep 1; do :; done
fi
exit 0
EOF
  chmod +x "$bin_dir/pnpm"
  cat >"$bin_dir/rm" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
if [[ "${RM_HARNESS_FAIL:-}" == "1" ]]; then
  case "$*" in
    *multideal-npmrc*) echo "rm harness fail" >&2; exit 1 ;;
  esac
fi
exec /bin/rm "$@"
EOF
  chmod +x "$bin_dir/rm"
  export PNPM_HARNESS_LOG="$log_file"
}

run_install() {
  local workdir="$1"
  local token="${2:-}"
  local mode="${3:-run}"
  local inject="${4:-}"
  local should_fail="${5:-0}"
  local log_file="$workdir/pnpm.log"
  local bin_dir="$workdir/bin"
  local status=0

  write_fake_tools "$bin_dir" "$log_file"

  (
    cd "$ROOT"
    export PATH="$bin_dir:$PATH"
    export GITHUB_PACKAGES_TOKEN="$token"
    unset NODE_AUTH_TOKEN PNPM_HARNESS_SHOULD_FAIL PNPM_HARNESS_SLEEP RM_HARNESS_FAIL
    if [[ "$should_fail" == "1" ]]; then
      export PNPM_HARNESS_SHOULD_FAIL=1
    fi
    case "$mode" in
      int|term) export PNPM_HARNESS_SLEEP=1 ;;
    esac
    case "$inject" in
      rm-fail) export RM_HARNESS_FAIL=1 ;;
    esac
    case "$mode" in
      int)
        timeout --preserve-status -s INT 1s bash scripts/setup-pnpm-install.sh
        ;;
      term)
        timeout --preserve-status -s TERM 1s bash scripts/setup-pnpm-install.sh
        ;;
      *)
        bash scripts/setup-pnpm-install.sh
        ;;
    esac
  ) >"$workdir/stdout" 2>"$workdir/stderr" || status=$?

  echo "$status"
}

# Token required when private deps exist.
status=0
(
  cd "$ROOT"
  export GITHUB_PACKAGES_TOKEN=
  unset NODE_AUTH_TOKEN
  bash scripts/setup-pnpm-install.sh
) >/dev/null 2>"$HARNESS_TMP/required.err" || status=$?
assert_eq 'missing token status' '1' "$status"
grep -Fq '@platform-modules dependencies' "$HARNESS_TMP/required.err" \
  || fail 'missing token error did not mention private deps'

# Token path creates ephemeral userconfig and removes it after success.
run_install "$HARNESS_TMP/success" 'ghp_harness_secret_token_value' >/dev/null
userconfig="$(grep -m1 '^userconfig=' "$HARNESS_TMP/success/pnpm.log" | cut -d= -f2-)"
if [[ -z "$userconfig" ]]; then
  fail 'fake pnpm did not receive NPM_CONFIG_USERCONFIG'
fi
assert_missing "$userconfig"
grep -Fq 'ghp_harness_secret_token_value' "$HARNESS_TMP/success/pnpm.log" \
  && fail 'token leaked into fake pnpm log'

# Failure path still removes ephemeral userconfig.
status="$(run_install "$HARNESS_TMP/failure" 'ghp_harness_secret_token_value' run '' 1)"
assert_eq 'install failure status' '9' "$status"
userconfig="$(grep -m1 '^userconfig=' "$HARNESS_TMP/failure/pnpm.log" | cut -d= -f2-)"
if [[ -z "$userconfig" ]]; then
  fail 'failure path did not set NPM_CONFIG_USERCONFIG'
fi
assert_missing "$userconfig"

# Signal paths preserve 130/143 and still clean up.
for mode in int term; do
  expected=130
  [[ "$mode" == "term" ]] && expected=143
  status="$(run_install "$HARNESS_TMP/$mode" 'ghp_harness_secret_token_value' "$mode")"
  assert_eq "$mode exit status" "$expected" "$status"
  userconfig="$(grep -m1 '^userconfig=' "$HARNESS_TMP/$mode/pnpm.log" | cut -d= -f2-)"
  if [[ -z "$userconfig" ]]; then
    fail "$mode path did not set NPM_CONFIG_USERCONFIG"
  fi
  assert_missing "$userconfig"
done

# Deletion failure fails closed on success path.
status="$(run_install "$HARNESS_TMP/rm-fail-success" 'ghp_harness_secret_token_value' run rm-fail)"
assert_eq 'rm-fail success status' '1' "$status"
assert_stderr_contains "$HARNESS_TMP/rm-fail-success/stderr" 'setup-pnpm-install cleanup:'

# Deletion failure preserves install failure on failure path.
status="$(run_install "$HARNESS_TMP/rm-fail-failure" 'ghp_harness_secret_token_value' run rm-fail 1)"
assert_eq 'rm-fail install failure status' '9' "$status"
assert_stderr_contains "$HARNESS_TMP/rm-fail-failure/stderr" 'setup-pnpm-install cleanup:'

# Repo .npmrc stays free of auth placeholders.
if grep -q 'NODE_AUTH_TOKEN' "$ROOT/.npmrc"; then
  fail 'repo .npmrc must not reference NODE_AUTH_TOKEN'
fi
if grep -q '_authToken' "$ROOT/.npmrc"; then
  fail 'repo .npmrc must not embed package auth tokens'
fi

echo 'all cases passed'