#!/usr/bin/env bash

# Rebinding a keyboard shortcut.
#
# This is the highest-consequence write in the settings app: a mistake here
# costs the user their keymap, and the keymap is how they reach everything else.
# The properties that matter:
#
#   * an override moves exactly the bind it names and nothing else -- keying by
#     description moved every bind sharing one, which silently cost the
#     XF86Calculator hardware key when SUPER+C was rebound;
#   * only the chord is ever stored, never the action;
#   * a chord already in use is refused rather than shadowing the existing bind;
#   * resetting returns the exact shipped keymap.

set -euo pipefail

repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
harness="$repo_dir/config/dot/quickshell/keybinds-harness.qml"
service="$repo_dir/config/dot/quickshell/services/Keybinds.qml"
settings_dir="$repo_dir/config/dot/quickshell/modules/settings"
page="$settings_dir/ShortcutsPage.qml"
row="$settings_dir/ShortcutRow.qml"

fail() {
    printf 'keybind rebind contract: %s\n' "$1" >&2
    exit 1
}

rg -Fq 'function overrideOccupantFor(chord: string, exceptShipped: string): string' "$service" \
    || fail 'resetBind has no override collision guard'
rg -Fq 'root.overrideOccupantFor(shipped, shipped)' "$service" \
    || fail 'resetBind does not check whether another override occupies its shipped chord'

# ── The page that drives all of the above ────────────────────────────────────
#
# The engine is exercised for real below, but the engine is only reachable
# through one screen, and the screen has been rebuilt around a per-row
# component. These pin the parts of that screen that carry consequence: every
# one of them is a way to lose the rebinding flow without any test noticing,
# because the service would still be perfectly correct.
#
# The row and the page are read as one source, so moving a control between them
# is not a failure -- removing it is.

[[ -r "$page" ]] || fail "cannot read $page"
[[ -r "$row" ]] || fail "cannot read $row -- the shortcut row component is gone"
browser="$(cat "$page" "$row")"

# The capture field is shared with nothing else and is the only thing in the
# tree that reads a chord without acting on it. A page that grew its own key
# handler instead would capture SUPER as a bind of its own.
grep -Fq 'ShortcutCapture' <<<"$browser" \
    || fail 'the shortcuts browser no longer uses ShortcutCapture, so something else is reading key presses'

for needle in \
    'Keybinds.boundTo(' \
    'Keybinds.rebind(' \
    'Keybinds.resetBind(' \
    'Keybinds.resetAll()' \
    'Keybinds.isOverridden(' \
    'text: "Change"' \
    'text: "Reset"'; do
    grep -Fq "$needle" <<<"$browser" \
        || fail "the shortcuts browser is missing $needle"
done

# boundTo before rebind. Without the check the write still succeeds and two
# actions end up on one chord, with whichever Hyprland reads last winning.
conflict_line="$(grep -n 'Keybinds.boundTo(' <<<"$browser" | head -1 | cut -d: -f1)"
write_line="$(grep -n 'Keybinds.rebind(' <<<"$browser" | head -1 | cut -d: -f1)"
[[ -n "$conflict_line" && -n "$write_line" && "$conflict_line" -lt "$write_line" ]] \
    || fail 'the chord in use is not checked before the rebind is written'

# Keyed by the shipped Lua chord, never by the description. Keying by
# description is what once moved every bind that shared one, silently costing
# the XF86Calculator hardware key when SUPER+C was rebound.
grep -Fq 'luaChord' <<<"$browser" \
    || fail 'the browser does not identify binds by their shipped Lua chord'
if grep -qE 'Keybinds\.(rebind|resetBind)\([^)]*description' <<<"$browser"; then
    fail 'a rebind or reset is keyed by description, which moves every bind that shares one'
fi

# Restoring everything stays reachable, and says how much it would undo.
rg -Fq 'Restore every shipped shortcut' "$page" \
    || fail 'the restore-all row is gone'
rg -Fq 'Object.keys(Keybinds.overrides).length' "$page" \
    || fail 'the restore-all row no longer counts what it would put back'

# ── Shortcuts the user invented ──────────────────────────────────────────────
#
# Overrides move a shipped bind and can only ever carry a chord, which is what
# the checks above are about. Custom shortcuts are the harder case: the stored
# entry has to describe an ACTION, and the file it is stored in is one the user
# can open in a text editor.
#
# It stays non-executable, and hypr/actions.lua is the whole reason. A stored
# entry is { chord, kind, target, label }: `kind` is an enum with three
# members, and `target` either names a key of a whitelist table whose values
# are command strings written in Lua by a human, or -- for an application -- is
# an identifier restricted to a character class containing no shell
# metacharacter, quoted as a single argv element for the launch-or-focus path.
#
# There is no third path. Nothing stored anywhere contributes a character to a
# command string. These pin that, because it is the property that makes the
# whole feature safe rather than a config-file injection with a settings page.

actions="$repo_dir/config/dot/hypr/actions.lua"
keybinds="$repo_dir/config/dot/hypr/keybinds.lua"
input_lua="$repo_dir/config/dot/hypr/input.lua"

[[ -r "$actions" ]] || fail "cannot read $actions -- the named-action resolver is gone"

# One resolver, required by both the things that resolve names.
grep -Fq 'require("actions")' "$keybinds" \
    || fail 'keybinds.lua does not use the named-action resolver'
grep -Fq 'require("actions")' "$input_lua" \
    || fail 'input.lua does not use the named-action resolver, so gestures resolve names some other way'

# The target character class. Written as a Lua pattern, so `-` is escaped as
# `%-`; the length bound is a separate check because Lua patterns have no {n,m}.
grep -Fq '"^[A-Za-z0-9@._%-]+$"' "$actions" \
    || fail 'the application target pattern is not the safe character class'
grep -Fq '#target <= 128' "$actions" \
    || fail 'the application target has no length bound'

# Every exec string in actions.lua comes from a table literal in actions.lua.
# The one place a stored value reaches a command is the launch-or-focus path,
# and there it is shell_quote()d -- an argument, not a fragment of a command.
python3 - "$actions" <<'PY' || fail 'actions.lua builds a command out of something other than its own whitelist tables'
import re, sys

source = open(sys.argv[1], encoding="utf-8").read()
# Whole-line comments only. A `--` anywhere else in a Lua line may well be
# inside a string -- "--class" is an argument this very file passes -- and
# treating it as a comment blinds the scan to the rest of the line.
lines = ["" if l.lstrip().startswith("--") else l for l in source.splitlines()]
problems = []

# Anything that puts `target` into a string being concatenated. Exactly two
# forms are permitted, both of which make it one quoted argv element rather
# than a fragment of a command; they are matched literally, so any third way of
# reaching a command string is a finding rather than a regex to be outwitted.
PERMITTED = (
    'shell_quote("^" .. escape_regex(target) .. "$")',
    "shell_quote(target)",
)
for number, line in enumerate(lines, 1):
    if "target" not in line:
        continue
    stripped = line
    for permitted in PERMITTED:
        stripped = stripped.replace(permitted, "")
    if re.search(r"\.\.\s*[A-Za-z_.]*target|target\s*\.\.", stripped):
        problems.append(f"line {number}: {line.strip()[:80]}")

# The command strings themselves are literals in the whitelist table.
for match in re.finditer(r"(?<![\w.])command\s*=\s*([^,\n]+)", source):
    value = match.group(1).strip()
    if not value.startswith('"'):
        problems.append(f"a whitelist command is not a literal: {value[:60]}")

# exec_cmd is only ever handed a whitelist command or the launcher command
# assembled from literals above it.
for number, line in enumerate(lines, 1):
    m = re.search(r"exec_cmd\(([^)]*)\)", line)
    if m and m.group(1).strip() not in ("verb.command", "launch_command"):
        problems.append(f"line {number}: exec_cmd takes {m.group(1).strip()[:60]}")

if problems:
    print("\n".join(problems), file=sys.stderr)
    raise SystemExit(1)
PY

# ── What the Lua actually emits ──────────────────────────────────────────────
#
# The static read above says the code is shaped right. This runs it, with a
# stubbed `hl` and a synthetic settings file, so the validation is exercised
# rather than trusted -- no compositor, no real preferences.

if command -v lua >/dev/null 2>&1; then
    lua_work="$(mktemp -d /tmp/panama-custom-binds.XXXXXX)"
    mkdir -p "$lua_work/config/panama" "$lua_work/state"

    # Every bind keybinds.lua emits, as "<chord>\t<description>\t<action>".
    emit_binds() {
        printf '%s' "$1" >"$lua_work/config/panama/settings.json"
        XDG_CONFIG_HOME="$lua_work/config" XDG_STATE_HOME="$lua_work/state" lua -e "
            package.path = '$repo_dir/config/dot/hypr/?.lua;' .. package.path
            hl = {
                config = function() end,
                dispatch = function() end,
                bind = function(chord, action, opts)
                    print(chord .. '\t' .. tostring((opts or {}).description) .. '\t' .. tostring(action))
                end,
                dsp = setmetatable({}, { __index = function(_, name)
                    local function node(path)
                        return setmetatable({}, {
                            __index = function(_, key) return node(path .. '.' .. key) end,
                            __call = function(_, argument)
                                if type(argument) == 'string' then
                                    return path .. '(' .. argument .. ')'
                                end
                                return path .. '()'
                            end,
                        })
                    end
                    return node(name)
                end }),
            }
            dofile('$keybinds')
        " 2>/dev/null
    }

    baseline="$(emit_binds '{}' | wc -l)"
    (( baseline > 100 )) || fail "the shipped keymap emitted $baseline binds, which cannot be right"

    # Two good entries, and seven ways of being wrong: an unknown shell verb, a
    # command in the target, a command in an app id, a workspace outside 1..10,
    # a kind nobody defined, an empty label, and a chord already taken by a
    # shipped bind.
    shipped_chord="$(emit_binds '{}' | cut -f1 | grep -Fx 'SUPER + T')"
    [[ -n "$shipped_chord" ]] || fail 'could not find a shipped chord to collide with'

    custom="$(emit_binds '{"customBinds":[
        {"chord":"SUPER + SHIFT + F1","kind":"shell","target":"dnd-toggle","label":"Do Not Disturb"},
        {"chord":"SUPER + SHIFT + F2","kind":"app","target":"org.gnome.Nautilus","label":"Files"},
        {"chord":"SUPER + SHIFT + F3","kind":"window","target":"workspace:4","label":"Workspace 4"},
        {"chord":"SUPER + SHIFT + F4","kind":"shell","target":"reboot","label":"Unknown verb"},
        {"chord":"SUPER + SHIFT + F5","kind":"shell","target":"dnd-toggle; reboot","label":"Command"},
        {"chord":"SUPER + SHIFT + F6","kind":"app","target":"foo $(reboot)","label":"Command in an id"},
        {"chord":"SUPER + SHIFT + F7","kind":"window","target":"workspace:0","label":"No such workspace"},
        {"chord":"SUPER + SHIFT + F8","kind":"exec","target":"reboot","label":"Invented kind"},
        {"chord":"SUPER + SHIFT + F9","kind":"shell","target":"overview","label":""},
        {"chord":"SUPER + T","kind":"shell","target":"lock","label":"Steals the terminal key"}
    ]}')"

    added=$(( $(wc -l <<<"$custom") - baseline ))
    (( added == 3 )) || fail "ten custom binds with seven invalid added $added binds, not 3"

    for chord in 'SUPER + SHIFT + F1' 'SUPER + SHIFT + F2' 'SUPER + SHIFT + F3'; do
        grep -Fq "$chord" <<<"$custom" || fail "the valid custom bind $chord was not emitted"
    done

    # The shipped key kept its action. A custom bind that collides loses; the
    # alternative is two binds on one chord and whichever Hyprland reads last.
    terminal_line="$(grep -F "$shipped_chord"$'\t' <<<"$custom" | head -1)"
    grep -Fq 'Terminal' <<<"$terminal_line" \
        || fail "a custom bind took over a shipped chord: $terminal_line"

    # Every custom bind carries the label as its description, because a bind
    # with no description is invisible to the cheatsheet and to the page that
    # would let you change it.
    while IFS=$'\t' read -r chord description _; do
        [[ -n "$description" && "$description" != "nil" ]] \
            || fail "the bind $chord has no description"
    done <<<"$custom"

    # And the actions are only ever whitelist commands or a quoted launch.
    while IFS=$'\t' read -r _ _ action; do
        case "$action" in
            *reboot*) fail "a stored target reached a command: $action" ;;
        esac
    done <<<"$custom"

    grep -Fq "panama-launch --class '^org\\.gnome\\.Nautilus\$' -- gtk-launch 'org.gnome.Nautilus'" <<<"$custom" \
        || fail "the app target is not passed as a quoted argument to the launch-or-focus path: $(grep -F 'SUPER + SHIFT + F2' <<<"$custom")"

    # Chords have a bound, and it is the same one overrides have. A 4 KB
    # "chord" is not a chord, it is a way to make hyprctl binds unreadable.
    long_chord="$(printf 'A%.0s' $(seq 1 65))"
    over="$(emit_binds "{\"customBinds\":[{\"chord\":\"$long_chord\",\"kind\":\"shell\",\"target\":\"lock\",\"label\":\"Long\"}]}" | wc -l)"
    (( over == baseline )) || fail 'a chord longer than 64 characters was bound anyway'

    # A malformed file costs the customizations and never the keymap.
    for broken in '{"customBinds":"nope"}' '{"customBinds":[null]}' '{"customBinds":[{"chord":42}]}'; do
        (( "$(emit_binds "$broken" | wc -l)" == baseline )) \
            || fail "a malformed customBinds value changed the shipped keymap: $broken"
    done

    rm -rf "$lua_work"
else
    fail 'lua is not installed, so what a custom shortcut becomes went unchecked'
fi

if [[ "${PANAMA_KEYBINDS_STATIC_ONLY:-0}" == "1" ]]; then
    printf 'keybind rebind contract: PASS (static)\n'
    exit 0
fi

config_home="$(mktemp -d /tmp/panama-rebind-config.XXXXXX)"

# The compositor is the live one -- that is the point -- but preferences are
# isolated so this cannot leave an override in the user's real settings.
# hyprctl reload re-reads the real settings file, so the compositor is only
# exercised through the shipped configuration here; the override logic itself is
# what is under test.
qs_for_harness() {
    XDG_CONFIG_HOME="$config_home" qs -p "$harness" "$@"
}

cleanup() {
    qs_for_harness ipc call keybinds-test resetAll >/dev/null 2>&1 || true
    qs_for_harness kill >/dev/null 2>&1 || true
    rm -rf "$config_home"
}
trap cleanup EXIT

XDG_CONFIG_HOME="$config_home" qs -p "$harness" --daemonize >/dev/null
for _ in $(seq 1 40); do
    qs_for_harness ipc show 2>/dev/null | rg -q '^target keybinds-test$' && break
    sleep 0.1
done
qs_for_harness ipc show 2>/dev/null | rg -q '^target keybinds-test$' || fail 'test IPC target did not start'

for _ in $(seq 1 40); do
    [[ "$(qs_for_harness ipc call keybinds-test status | jq -r .loaded)" == "true" ]] && break
    sleep 0.1
done

# ── Nothing is overridden to begin with ──────────────────────────────────────
[[ "$(qs_for_harness ipc call keybinds-test overrideState | jq -r .count)" == "0" ]] \
    || fail 'the isolated store started with overrides'

# ── A chord already in use is refused ────────────────────────────────────────
terminal="$(qs_for_harness ipc call keybinds-test chordFor Terminal)"
[[ -n "$terminal" ]] || fail 'could not find the Terminal bind'
files="$(qs_for_harness ipc call keybinds-test chordFor Files)"
[[ -n "$files" ]] || fail 'could not find the Files bind'

[[ "$(qs_for_harness ipc call keybinds-test rebind "$terminal" "$files")" == "false" ]] \
    || fail 'rebinding onto a chord already in use was accepted'
[[ "$(qs_for_harness ipc call keybinds-test overrideState | jq -r .count)" == "0" ]] \
    || fail 'a refused rebind still stored an override'

# ── A rebind stores only the chord, keyed by the shipped chord ───────────────
[[ "$(qs_for_harness ipc call keybinds-test rebind "$terminal" "SUPER + SHIFT + F9")" == "true" ]] \
    || fail 'a valid rebind was refused'

state="$(qs_for_harness ipc call keybinds-test overrideState)"
jq -e --arg k "$terminal" '.overrides[$k] == "SUPER + SHIFT + F9"' <<<"$state" >/dev/null \
    || fail "the override was not keyed by the shipped chord: $state"
jq -e '.count == 1' <<<"$state" >/dev/null || fail "exactly one override expected: $state"

# Only a chord is stored. Nothing resembling an action or command may appear,
# because that is what keeps a user-editable file from being executable.
jq -e '[.overrides[]] | all(type == "string" and (length < 64))' <<<"$state" >/dev/null \
    || fail 'an override value is not a plain chord'

# ── Reset clears it ──────────────────────────────────────────────────────────
qs_for_harness ipc call keybinds-test resetAll >/dev/null
sleep 0.5
[[ "$(qs_for_harness ipc call keybinds-test overrideState | jq -r .count)" == "0" ]] \
    || fail 'resetAll left overrides behind'

# Terminal moved away from its shipped chord, then Files moved into it.
# Resetting Terminal must refuse instead of producing two binds on one chord.
qs_for_harness ipc call keybinds-test seedResetCollision \
    "$terminal" "SUPER + SHIFT + F9" "$files" >/dev/null
sleep 0.2
[[ "$(qs_for_harness ipc call keybinds-test resetBind "SUPER + SHIFT + F9")" == "false" ]] \
    || fail 'resetBind reclaimed a shipped chord occupied by another override'
collision_state="$(qs_for_harness ipc call keybinds-test overrideState)"
jq -e --arg terminal "$terminal" --arg files "$files" \
    '.count == 2 and .overrides[$terminal] == "SUPER + SHIFT + F9" and .overrides[$files] == $terminal and (.lastError | length > 0)' \
    <<<"$collision_state" >/dev/null \
    || fail "a refused reset changed overrides or gave no explanation: $collision_state"

trap - EXIT
cleanup
printf 'keybind rebind contract: PASS\n'