#!/usr/bin/env bash
# Runs ON a build box (shipped over ssh by bin/buildbox). Declares the state a box
# must converge to; never copies state from another box.
#   checks.sh audit      -> print OK/DRIFT per item, exit 1 on any drift
#   checks.sh bootstrap  -> converge user-level items, report root-level ones
set -uo pipefail

MODE="${1:-audit}"
drift=0

ok()    { printf 'OK    %-14s %s\n' "$1" "$2"; }
bad()   { printf 'DRIFT %-14s %s\n' "$1" "$2"; drift=1; }
fixed() { printf 'FIXED %-14s %s\n' "$1" "$2"; }

export PATH="$HOME/.local/share/mise/shims:$HOME/.local/bin:$HOME/.cargo/bin:$PATH"

NODE_MAJOR=24
BUN_MAJOR=1

item_mise() {
  if command -v mise >/dev/null 2>&1; then ok mise "$(mise --version 2>/dev/null | head -1)"; return; fi
  if [ "$MODE" = bootstrap ]; then
    curl -fsSL https://mise.run | sh >/dev/null 2>&1 && fixed mise installed || bad mise "install failed"
  else
    bad mise missing
  fi
}

item_node() {
  local v; v=$(node --version 2>/dev/null)
  case "$v" in
    v${NODE_MAJOR}.*) ok node "$v"; return;;
  esac
  if [ "$MODE" = bootstrap ] && command -v mise >/dev/null 2>&1; then
    mise use -g "node@${NODE_MAJOR}" >/dev/null 2>&1 && fixed node "$(node --version 2>/dev/null)" || bad node "mise install failed (was: ${v:-absent})"
  else
    bad node "want v${NODE_MAJOR}.x, have ${v:-none}"
  fi
}

item_corepack_shims() {
  if [ -x "$HOME/.local/bin/pnpm" ]; then ok corepack-shims "$HOME/.local/bin/pnpm"; return; fi
  if [ "$MODE" = bootstrap ]; then
    mkdir -p "$HOME/.local/bin" \
      && COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack enable --install-directory "$HOME/.local/bin" >/dev/null 2>&1 \
      && fixed corepack-shims "$HOME/.local/bin/pnpm" || bad corepack-shims "corepack enable failed"
  else
    bad corepack-shims "pnpm shim missing in ~/.local/bin"
  fi
}

item_bun() {
  local v; v=$(bun --version 2>/dev/null)
  case "$v" in
    ${BUN_MAJOR}.*) ok bun "$v"; return;;
  esac
  if [ "$MODE" = bootstrap ]; then
    curl -fsSL https://bun.sh/install | bash >/dev/null 2>&1 && fixed bun "$("$HOME/.bun/bin/bun" --version 2>/dev/null)" || bad bun "install failed (was: ${v:-absent})"
  else
    bad bun "want ${BUN_MAJOR}.x, have ${v:-none}"
  fi
}

item_rust() {
  if command -v cargo >/dev/null 2>&1; then ok rust "$(cargo --version 2>/dev/null | cut -d' ' -f2)"; return; fi
  if [ "$MODE" = bootstrap ]; then
    curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal >/dev/null 2>&1 \
      && fixed rust "$("$HOME/.cargo/bin/cargo" --version | cut -d' ' -f2)" || bad rust "rustup install failed"
  else
    bad rust missing
  fi
}

item_builds_dir() {
  if [ -d "$HOME/builds" ]; then ok builds-dir "$HOME/builds"; return; fi
  if [ "$MODE" = bootstrap ]; then mkdir -p "$HOME/builds" && fixed builds-dir "$HOME/builds"; else bad builds-dir missing; fi
}

item_linger() {
  if [ "$(loginctl show-user "$USER" -p Linger --value 2>/dev/null)" = yes ]; then ok linger yes; return; fi
  if [ "$MODE" = bootstrap ] && loginctl enable-linger "$USER" 2>/dev/null; then fixed linger enabled; else
    bad linger "disabled — systemd-run --user jobs die on disconnect (needs root: loginctl enable-linger $USER)"
  fi
}

item_npmrc_token() {
  if grep -q _authToken "$HOME/.npmrc" 2>/dev/null; then ok npmrc-token present; return; fi
  # secret comes from the workstation; bin/buildbox appends it before invoking bootstrap
  bad npmrc-token "no _authToken in ~/.npmrc (private registry installs will 401)"
}

# root-installed, report-only: never mutated from here
item_system() {
  command -v git >/dev/null 2>&1 && ok git "$(git --version | cut -d' ' -f3)" || bad git "missing (root: apt install git)"
  command -v rsync >/dev/null 2>&1 && ok rsync "$(rsync --version | awk 'NR==1{print $3}')" || bad rsync "missing (root: apt install rsync)"
  command -v flock >/dev/null 2>&1 && ok flock present || bad flock "missing (root: apt install util-linux)"
}

item_mise
item_node
item_corepack_shims
item_bun
item_rust
item_builds_dir
item_linger
item_npmrc_token
item_system

exit "$drift"