#!/usr/bin/env bash
# item_devtools drives every box's third-party tool state off devtools.json. Exercised here
# against a throwaway HOME and a local repo standing in for GitHub, so the audit verdicts and
# the bootstrap convergence are checked without touching the fleet.
set -euo pipefail

CHECKS="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/lib/buildbox-checks.sh"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT
fail=0
check() { [ "$2" = "$3" ] && printf 'ok   %s\n' "$1" || { printf 'FAIL %s\n  want: %s\n  got:  %s\n' "$1" "$3" "$2"; fail=1; }; }

upstream="$WORK/upstream"
git init -q "$upstream"
mkdir -p "$upstream/bin"
printf '#!/bin/sh\necho hi\n' > "$upstream/bin/tool"
chmod 755 "$upstream/bin/tool"
git -C "$upstream" -c user.name=t -c user.email=t@t add -A
git -C "$upstream" -c user.name=t -c user.email=t@t commit -qm init
ref=$(git -C "$upstream" rev-parse HEAD)

decl=$(printf '{"root":"~/.dev-tools","tools":[{"name":"probe","repo":"%s","ref":"%s","install":"touch built","bins":{"probe":"bin/tool"}}]}' "$upstream" "$ref")

# Only item_devtools is under test; the file runs every item at load, so it is sourced with a
# HOME that has nothing else in it and the unrelated verdicts are dropped.
run() {
  HOME="$WORK/home" DEVTOOLS_B64=$(printf %s "$decl" | base64 -w0) \
    bash "$CHECKS" "$1" 2>/dev/null | grep -E '(^| )probe ' || true
}

mkdir -p "$WORK/home"
check "absent box reports drift" "$(run audit | awk '{print $1, $2, $3}')" "DRIFT probe absent"

run bootstrap >/dev/null
check "bootstrap checks out the pinned ref" "$(git -C "$WORK/home/.dev-tools/probe" rev-parse HEAD)" "$ref"
check "bootstrap runs the install command" "$([ -f "$WORK/home/.dev-tools/probe/built" ] && echo yes)" "yes"
check "bootstrap links the declared bin" "$(readlink "$WORK/home/.local/bin/probe")" "$WORK/home/.dev-tools/probe/bin/tool"
check "converged box audits clean" "$(run audit | awk '{print $1, $2}')" "OK probe"

# A ref bump must rebuild: the checkout moves, so the build stamp no longer matches.
printf 'v2\n' >> "$upstream/bin/tool"
git -C "$upstream" -c user.name=t -c user.email=t@t commit -qam v2
ref=$(git -C "$upstream" rev-parse HEAD)
decl=${decl/$(git -C "$WORK/home/.dev-tools/probe" rev-parse HEAD)/$ref}
rm "$WORK/home/.dev-tools/probe/built"
check "ref bump reports drift" "$(run audit | awk '{print $1, $2}')" "DRIFT probe"
run bootstrap >/dev/null
check "ref bump converges" "$(git -C "$WORK/home/.dev-tools/probe" rev-parse HEAD)" "$ref"
check "ref bump rebuilds" "$([ -f "$WORK/home/.dev-tools/probe/built" ] && echo yes)" "yes"

stale() {
  HOME="$WORK/home" DEVTOOLS_B64=$(printf '{"tools":[],"forbidden":{"paths":["~/.local/bin/ghost"]}}' | base64 -w0) \
    bash "$CHECKS" "$1" 2>/dev/null | grep 'stale-artifacts' || true
}
check "clean box has no stale artifacts" "$(stale audit | awk '{print $1, $2}')" "OK stale-artifacts"
touch "$WORK/home/.local/bin/ghost"
check "undeclared artifact reports drift" "$(stale audit | awk '{print $1, $2}')" "DRIFT stale-artifacts"
stale bootstrap >/dev/null
check "bootstrap removes it" "$([ -e "$WORK/home/.local/bin/ghost" ] && echo present || echo gone)" "gone"

exit "$fail"