#!/usr/bin/env bash
set -euo pipefail

ROOT="$(mktemp -d "${XDG_CACHE_HOME:-$HOME/.cache}/overdeck/tests/sandbox-image-build.XXXXXX")"
trap 'rm -rf "$ROOT"' EXIT
mkdir -p "$ROOT/image-context" "$ROOT/lib" "$ROOT/mock-bin"
printf 'FROM scratch\n' >"$ROOT/image-context/Containerfile"
printf 'FROM scratch\n' >"$ROOT/image-context/Containerfile.e2e"
cp "$(cd "$(dirname "${BASH_SOURCE[0]}")/../host/lib" && pwd)/image-context.sh" "$ROOT/lib/"
printf 'stale\n' >"$ROOT/agent-image-digest"
printf 'stale\n' >"$ROOT/e2e-image-digest"

cat >"$ROOT/mock-bin/podman" <<'MOCK'
#!/usr/bin/env bash
printf '%s\n' "$*" >>"$SANDBOX_MOCK_CALLS"
case "$1 $2" in
  "image exists") exit 0 ;;
  "image inspect") printf '[local] 1\n[local] 1\n'; exit 0 ;;
  "images --format") exit 0 ;;
  "tag "*) exit 0 ;;
  "push "*) echo 'push must not run in local-only mode' >&2; exit 97 ;;
  "rmi "*) exit 0 ;;
esac
exit 0
MOCK
chmod +x "$ROOT/mock-bin/podman"

BUILDER="$(cd "$(dirname "${BASH_SOURCE[0]}")/../host/bin" && pwd)/sandbox-image-build"
PROVISION="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../workstation/claude/bin" && pwd)/sandbox-provision"
SANDBOX_HOST_ROOT="$ROOT" SANDBOX_MOCK_CALLS="$ROOT/calls" \
  PATH="$ROOT/mock-bin:$PATH" "$BUILDER" --local-only

if grep -q '^push ' "$ROOT/calls"; then
  echo 'sandbox-image-build local-only test: unexpected registry push' >&2
  exit 1
fi
[ -s "$ROOT/agent-image-tag" ]
[ -s "$ROOT/e2e-image-tag" ]
[ ! -e "$ROOT/agent-image-digest" ]
[ ! -e "$ROOT/e2e-image-digest" ]

# Literal remote-script contract: the provisioner must preserve force while selecting local-only.
# shellcheck disable=SC2016
grep -Fq '"$ROOT/bin/sandbox-image-build" --local-only ${SANDBOX_BUILD_FORCE:-}' "$PROVISION"

IMMUTABLE="$ROOT/immutable"
STAGED="$ROOT/staged"
mkdir -p "$IMMUTABLE/image/lib" "$IMMUTABLE/overlays" "$STAGED/bin" "$STAGED/lib" "$STAGED/image-context"
printf 'base\n' >"$IMMUTABLE/image/base.txt"
printf 'old-payload\n' >"$IMMUTABLE/image/lib/sandbox-payload.mjs"
printf 'payload\n' >"$IMMUTABLE/overlays/sandbox-payload.mjs"
printf 'pair\n' >"$IMMUTABLE/overlays/e2e-pair.sh"
chmod -R a-w "$IMMUTABLE"
cp -r "$IMMUTABLE/image/." "$STAGED/image-context/"
chmod -R u+w "$STAGED/image-context"
mkdir -p "$STAGED/image-context/lib"
cp "$IMMUTABLE/overlays/sandbox-payload.mjs" "$STAGED/image-context/lib/"
cp "$IMMUTABLE/overlays/e2e-pair.sh" "$STAGED/image-context/lib/e2e-pair.sh"
mode_hash_before="$(find "$STAGED/image-context" -type f -print0 | sort -z | xargs -0 sha256sum | sha256sum)"
chmod -R u+w "$STAGED/bin" "$STAGED/lib" "$STAGED/image-context"
mode_hash_after="$(find "$STAGED/image-context" -type f -print0 | sort -z | xargs -0 sha256sum | sha256sum)"
[ "$mode_hash_before" = "$mode_hash_after" ]
[ "$(<"$STAGED/image-context/lib/sandbox-payload.mjs")" = payload ]
[ "$(stat -c %a "$STAGED/image-context/lib/sandbox-payload.mjs")" = 644 ]
[ "$(stat -c %a "$STAGED/image-context/lib/e2e-pair.sh")" = 644 ]
[ "$(stat -c %a "$IMMUTABLE/overlays/sandbox-payload.mjs")" = 444 ]
# shellcheck disable=SC2016
grep -Fq 'chmod -R u+w "$STAGE/image-context"' "$PROVISION"
# shellcheck disable=SC2016
grep -Fq 'chmod -R u+w "$STAGE/bin" "$STAGE/lib" "$STAGE/image-context"' "$PROVISION"
chmod -R u+w "$IMMUTABLE"
rm -rf "$STAGED"
[ ! -e "$STAGED" ]

BROKEN="$ROOT/broken"
mkdir -p "$BROKEN"
printf 'stale\n' >"$BROKEN/agent-image-digest"
printf 'stale\n' >"$BROKEN/e2e-image-digest"
if SANDBOX_HOST_ROOT="$BROKEN" "$BUILDER" --local-only >/dev/null 2>&1; then
  echo 'sandbox-image-build local-only test: missing context unexpectedly passed' >&2
  exit 1
fi
[ ! -e "$BROKEN/agent-image-digest" ]
[ ! -e "$BROKEN/e2e-image-digest" ]
printf 'sandbox-image-build local-only test: PASS\n'