#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
E2E_REMOTE="$ROOT/bin/e2e-remote"
SEAT_ATTEST="$ROOT/lib/seat-attest.sh"
TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT

# shellcheck disable=SC1090
. "$SEAT_ATTEST"

fail() {
  echo "FAIL: $*" >&2
  exit 1
}

ok() {
  echo "OK: $*"
}

if OVERDECK_SEAT_HOST="$(hostname)" OVERDECK_SEAT_ID="seat-x" \
  "$E2E_REMOTE" -- node -e 'process.exit(42)' >"$TMP/spoof.out" 2>"$TMP/spoof.err"; then
  fail "e2e-remote spoof should fail closed"
fi
grep -q "seat-attest" "$TMP/spoof.err" || fail "spoof stderr missing seat-attest"
ok "e2e-remote rejects spoofed seat env"

FIXTURE="$TMP/fixture"
MOCK_BIN="$TMP/mock-bin"
seat_id="seat-x"
mkdir -p "$FIXTURE/proc-self/ns" "$FIXTURE/netns" "$MOCK_BIN"
netns_file="$FIXTURE/netns/overdeck-seat-${seat_id}"
echo -n '' >"$netns_file"
echo "0::/user.slice/agent-seat.slice/agent-seat-${seat_id}.scope" >"$FIXTURE/proc-self/cgroup"
ln -sf "$netns_file" "$FIXTURE/proc-self/ns/net"

cat >"$MOCK_BIN/stat" <<'MOCK'
#!/usr/bin/env bash
if [ "$1" = "-c" ] && [ "$2" = "%u" ]; then
  path="${@: -1}"
  case "$path" in
    */overdeck-seat-*) echo 0; exit 0 ;;
  esac
fi
exec /usr/bin/stat "$@"
MOCK
chmod +x "$MOCK_BIN/stat"

export OVERDECK_SEAT_ID="$seat_id"
export OVERDECK_SEAT_HOST="$(hostname)"
export PATH="$MOCK_BIN:$PATH"

if ! _overdeck_seat_attest "$FIXTURE/proc-self" "$FIXTURE/netns/overdeck-seat-${seat_id}"; then
  fail "attested fixture should pass seat-attest"
fi
ok "seat-attest accepts attested fixture"

other_netns="$FIXTURE/netns/other-netns"
echo -n '' >"$other_netns"
ln -sf "$other_netns" "$FIXTURE/proc-self/ns/net"
if _overdeck_seat_attest "$FIXTURE/proc-self" "$FIXTURE/netns/overdeck-seat-${seat_id}"; then
  fail "mismatched netns stat identity should fail seat-attest"
fi
ln -sf "$netns_file" "$FIXTURE/proc-self/ns/net"
ok "seat-attest rejects netns stat identity mismatch"

ENV_ARGS=('OD_TEST_VAR=has spaces' 'PLAIN=ok')
for kv in "${ENV_ARGS[@]}"; do export "$kv"; done
[ "${OD_TEST_VAR:-}" = "has spaces" ] || fail "ENV_ARGS loop must preserve spaces"
[ "${PLAIN:-}" = "ok" ] || fail "ENV_ARGS loop must preserve plain values"
grep -q 'for kv in "${ENV_ARGS\[@\]}"; do' "$E2E_REMOTE" || fail "e2e-remote must iterate ENV_ARGS without word-splitting"
ok "ENV_ARGS loop preserves spaces"

echo "e2e-remote attest tests passed"