#!/usr/bin/env bash
set -euo pipefail
umask 077
export PYTHONDONTWRITEBYTECODE=1
HERE=$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
ROOT=$(CDPATH= cd -- "$HERE/../../.." && pwd)
TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT

run_once() {
  local name=$1
  "$ROOT/tools/k3s/enroll-node.sh" debian4 --dry-run \
    --repo-root "$ROOT" \
    --fixture "$HERE/fixtures/phase2-debian4.json" \
    --receipt-dir "$TMP/$name" \
    --lock-file "$TMP/$name.lock"
  "$ROOT/tools/k3s/validate-enrollment-receipt.py" --receipt "$TMP/$name" --candidate debian4 \
    >"$TMP/$name.validation.json"
}
run_once first
run_once second
cmp "$TMP/first/plan.json" "$TMP/second/plan.json"
cmp "$TMP/first/PLAN.txt" "$TMP/second/PLAN.txt"
cmp "$TMP/first/registry-preview/fleet.json" "$TMP/second/registry-preview/fleet.json"
cmp "$TMP/first/registry-preview/buildbox-hosts.json" "$TMP/second/registry-preview/buildbox-hosts.json"
cmp "$TMP/first/registry-preview/pair.json" "$TMP/second/registry-preview/pair.json"

python3 - "$TMP/first/phase2-result.json" <<'PY'
import json, sys
value=json.load(open(sys.argv[1], encoding='utf-8'))
assert value['status']=='success'
assert value['git_publication_allowed'] is True
assert value['plan_step_count']==17
for key in ('live_mutation_performed','candidate_mutation_performed','cluster_mutation_performed','registry_mutation_performed','phase3_authorized'):
    assert value[key] is False, key
assert value['source_digests_before']==value['source_digests_after']
PY

if "$ROOT/tools/k3s/enroll-node.sh" debian4 --apply \
  --repo-root "$ROOT" --fixture "$HERE/fixtures/phase2-debian4.json" \
  --receipt-dir "$TMP/forbidden" --lock-file "$TMP/forbidden.lock" >/dev/null 2>&1; then
  echo 'Phase 2 unexpectedly accepted --apply' >&2
  exit 1
fi

grep -RIEq 'AGE-SECRET-KEY-|BEGIN .*PRIVATE KEY|K10[0-9a-f]{64}::|[a-z0-9]{6}\.[a-z0-9]{16}' "$TMP/first" && {
  echo 'secret-like value found in receipt' >&2
  exit 1
} || true

echo 'phase2 deterministic dry-run transaction: passed'