#!/usr/bin/env bash

# The public seam is the installed `panama` command. This fixture repository
# proves the runner's manifest policy and diagnostics without touching the host.

set -uo pipefail

repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
fixture="$(mktemp -d)"
output=""
status=0

cleanup() { rm -rf -- "$fixture"; }
trap cleanup EXIT INT TERM

fail() { printf 'test runner: %s\n' "$*" >&2; exit 1; }

assert_contains() {
    local needle="$1" haystack="$2"
    [[ "$haystack" == *"$needle"* ]] || fail "expected output to contain: $needle\n$haystack"
}

assert_not_contains() {
    local needle="$1" haystack="$2"
    [[ "$haystack" != *"$needle"* ]] || fail "expected output not to contain: $needle\n$haystack"
}

assert_execution() {
    local expected="$1" actual
    actual="$(sort "$fixture/executions" 2>/dev/null || true)"
    [[ "$actual" == "$expected" ]] || fail "expected executions '$expected', got '$actual'"
}

reset_executions() { : > "$fixture/executions"; }

run_panama() {
    output="$(cd "$fixture" && TMPDIR="$fixture" PANAMA_TEST_FIXTURE="$fixture" "$fixture/bin/panama" "$@" </dev/null 2>&1)"
    status=$?
}

run_panama_with_timeout() {
    output="$(cd "$fixture" && TMPDIR="$fixture" PANAMA_TEST_TIMEOUT_SECONDS=1 PANAMA_TEST_FIXTURE="$fixture" "$fixture/bin/panama" "$@" </dev/null 2>&1)"
    status=$?
}

run_panama_tty_default_no() {
    local command tty_stdout="$fixture/tty.stdout"
    printf -v command 'cd %q && TMPDIR=%q PANAMA_TEST_FIXTURE=%q %q test composite > %q' \
        "$fixture" "$fixture" "$fixture" "$fixture/bin/panama" "$tty_stdout"
    output="$(python3 - "$command" <<'PY'
import errno
import os
import pty
import sys

command = sys.argv[1]
pid, terminal = pty.fork()
if pid == 0:
    os.execv('/bin/bash', ['bash', '-lc', command])

chunks = []
replied = False
while True:
    try:
        chunk = os.read(terminal, 1024)
    except OSError as error:
        if error.errno == errno.EIO:
            break
        raise
    if not chunk:
        break
    chunks.append(chunk)
    if not replied and b'[y/N]' in b''.join(chunks):
        os.write(terminal, b'\n')
        replied = True

_, child_status = os.waitpid(pid, 0)
sys.stdout.buffer.write(b''.join(chunks))
sys.exit(os.waitstatus_to_exitcode(child_status))
PY
)"
    status=$?
}

assert_occurrences() {
    local needle="$1" haystack="$2" expected="$3" actual
    actual="$(grep -oF -- "$needle" <<<"$haystack" | wc -l)"
    [[ "$actual" == "$expected" ]] || fail "expected $expected occurrence(s) of '$needle', got $actual\n$haystack"
}

mkdir -p "$fixture/bin" "$fixture/tests" "$fixture/config"
cp "$repo_dir/bin/panama" "$fixture/bin/panama"
chmod +x "$fixture/bin/panama"
touch "$fixture/config/subject"
git -C "$fixture" init --quiet

cat > "$fixture/tests/contracts.manifest" <<'EOF'
# Maps the live desktop and reads compositor state.
live-compositor,live-desktop tests/composite-contract
# Maps the live desktop.
live-desktop tests/desktop-contract
hermetic tests/fail-contract
hermetic tests/hang-contract
# Reads a host fixture.
live-host tests/host-contract
# Contacts a fixture endpoint.
network tests/network-contract
hermetic tests/pass-contract
# Elevates a fixture boundary.
privileged tests/privileged-contract
hermetic tests/stderr-contract
EOF

cat > "$fixture/tests/pass-contract" <<'EOF'
#!/usr/bin/env bash
printf 'pass\n' >> "$PANAMA_TEST_FIXTURE/executions"
printf 'pass stdout\n'
# config/subject
EOF

cat > "$fixture/tests/fail-contract" <<'EOF'
#!/usr/bin/env bash
printf 'fail\n' >> "$PANAMA_TEST_FIXTURE/executions"
printf 'failure stdout\n'
printf 'failure stderr\n' >&2
exit 7
EOF

cat > "$fixture/tests/stderr-contract" <<'EOF'
#!/usr/bin/env bash
printf 'stderr\n' >> "$PANAMA_TEST_FIXTURE/executions"
printf 'warning on success\n' >&2
EOF

cat > "$fixture/tests/hang-contract" <<'EOF'
#!/usr/bin/env bash
printf 'hang\n' >> "$PANAMA_TEST_FIXTURE/executions"
trap 'printf terminated >"$PANAMA_TEST_FIXTURE/terminated"; exit 124' TERM
while :; do sleep 1; done
EOF

cat > "$fixture/tests/host-contract" <<'EOF'
#!/usr/bin/env bash
printf 'host\n' >> "$PANAMA_TEST_FIXTURE/executions"
EOF

cat > "$fixture/tests/desktop-contract" <<'EOF'
#!/usr/bin/env bash
printf 'desktop\n' >> "$PANAMA_TEST_FIXTURE/executions"
# config/subject
EOF

cat > "$fixture/tests/composite-contract" <<'EOF'
#!/usr/bin/env bash
printf 'composite\n' >> "$PANAMA_TEST_FIXTURE/executions"
# config/subject
EOF

cat > "$fixture/tests/network-contract" <<'EOF'
#!/usr/bin/env bash
printf 'network\n' >> "$PANAMA_TEST_FIXTURE/executions"
EOF

cat > "$fixture/tests/privileged-contract" <<'EOF'
#!/usr/bin/env bash
printf 'privileged\n' >> "$PANAMA_TEST_FIXTURE/executions"
EOF

chmod +x "$fixture/tests"/{composite,desktop,fail,hang,host,network,pass,privileged,stderr}-contract
: > "$fixture/executions"

# A PTY-backed default-no confirmation remains visible when stdout is redirected
# but stdin and stderr are terminals. The fixture proves that one prompt gates
# the selected composite capability set without running its contract.
run_panama_tty_default_no
[[ $status -ne 0 ]] || fail 'TTY default-no prompt unexpectedly ran the fixture'
assert_execution ''
assert_contains 'Run 1 contract(s) requiring: live-compositor live-desktop?' "$output"
assert_occurrences 'Run 1 contract(s) requiring:' "$output" 1
assert_contains 'No contracts were run.' "$(<"$fixture/tty.stdout")"
assert_not_contains 'Run 1 contract(s) requiring:' "$(<"$fixture/tty.stdout")"

# --safe must select hermetic entries from the manifest, not merely omit a
# legacy desktop list. The failing and timed-out fixtures make the command
# nonzero, but every selected hermetic contract still runs and each external
# capability reports its skipped count.
rm -f -- "$fixture/terminated"
run_panama_with_timeout test --safe
[[ $status -ne 0 ]] || fail '--safe unexpectedly passed a failing fixture'
assert_execution $'fail\nhang\npass\nstderr'
[[ -f "$fixture/terminated" ]] || fail '--safe did not run and terminate the hermetic hang fixture'
assert_contains 'Skipped 1 live-host contract(s).' "$output"
assert_contains 'Skipped 1 live-compositor contract(s).' "$output"
assert_contains 'Skipped 2 live-desktop contract(s).' "$output"
assert_contains 'Skipped 1 network contract(s).' "$output"
assert_contains 'Skipped 1 privileged contract(s).' "$output"

reset_executions
run_panama test desktop
[[ $status -ne 0 ]] || fail 'non-TTY desktop run unexpectedly passed without a grant'
assert_execution ''
assert_contains 'pass --allow live-desktop' "$output"

run_panama test --allow live-desktop desktop
[[ $status -eq 0 ]] || fail "explicit desktop grant failed: $output"
assert_execution 'desktop'

reset_executions
run_panama test --allow live-compositor --allow live-desktop composite
[[ $status -eq 0 ]] || fail "repeatable grants failed: $output"
assert_execution 'composite'

reset_executions
run_panama test --allow live-desktop network
[[ $status -ne 0 ]] || fail 'desktop grant incorrectly allowed network'
assert_execution ''
assert_contains 'network' "$output"

for args in '--unknown' 'pass-contract second-pattern' '--allow unknown' '--safe --allow live-desktop'; do
    # shellcheck disable=SC2086
    run_panama test $args
    [[ $status -eq 2 ]] || fail "usage error did not exit 2 for: $args\n$output"
done

reset_executions
run_panama_with_timeout test hang
[[ $status -ne 0 ]] || fail 'timed-out contract unexpectedly passed'
assert_execution 'hang'
[[ -f "$fixture/terminated" ]] || fail 'timed-out contract was not terminated with TERM'
assert_contains 'timed out' "$output"

reset_executions
run_panama test fail
[[ $status -ne 0 ]] || fail 'failed contract unexpectedly passed'
assert_contains 'failure stdout' "$output"
assert_contains 'failure stderr' "$output"

reset_executions
run_panama test stderr
[[ $status -eq 0 ]] || fail "stderr success contract failed: $output"
assert_contains 'warning on success' "$output"

reset_executions
run_panama test pass
[[ $status -eq 0 ]] || fail "pass contract failed: $output"
assert_not_contains 'pass stdout' "$output"

reset_executions
run_panama test --safe desktop
[[ $status -ne 0 ]] || fail 'only-skipped pattern unexpectedly passed'
assert_contains 'Every contract matching' "$output"
assert_not_contains 'No contracts match' "$output"

output="$(cd "$fixture" && "$fixture/bin/panama" contracts config/subject 2>&1)"
status=$?
[[ $status -eq 0 ]] || fail "contracts lookup failed: $output"
assert_contains 'tests/desktop-contract  [live-desktop]' "$output"
assert_contains 'tests/composite-contract  [live-compositor,live-desktop]' "$output"
assert_contains 'tests/pass-contract  [hermetic]' "$output"

mv "$fixture/tests/contracts.manifest" "$fixture/tests/contracts.manifest.missing"
run_panama test pass
[[ $status -ne 0 ]] || fail 'missing manifest unexpectedly allowed test execution'
assert_contains 'contracts.manifest' "$output"
mv "$fixture/tests/contracts.manifest.missing" "$fixture/tests/contracts.manifest"

capture_dirs="$(find "$fixture" -mindepth 1 -maxdepth 1 -type d -name 'tmp.*' -print)"
[[ -z "$capture_dirs" ]] || fail "runner leaked capture directory: $capture_dirs"

printf 'test runner: PASS\n'