#!/usr/bin/env bash

# Every "open the settings for this" jump must land somewhere real.
#
# ShellState.openSettings() validates its argument against an allow-list and
# falls back to Home for anything unknown. That fallback is sensible and it is
# also completely silent: a typo, or a page renamed later, turns a right-click
# into "opens Settings on the wrong page" with nothing logged and no error.
#
# Before this, exactly four places in the entire shell could reach Settings, so
# the risk was small. The bar now offers a jump on every widget, which makes the
# fallback worth guarding.

set -uo pipefail

repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
shell_state="$repo_dir/config/dot/quickshell/services/ShellState.qml"
modules="$repo_dir/config/dot/quickshell/modules"

fail() {
    printf 'settings jump contract: %s\n' "$1" >&2
    exit 1
}

allowed_line="$(grep -m1 'const allowed = \[' "$shell_state")" \
    || fail 'could not find the allow-list in ShellState'

jumps="$(grep -rhoE 'openSettings\("[a-z-]+"\)' "$modules" 2>/dev/null \
    | sed 's/openSettings("//; s/")//' | sort -u)"
[[ -n "$jumps" ]] || fail 'found no settings jumps at all -- this contract is not reading the modules correctly'

count=0
while read -r page; do
    [[ -n "$page" ]] || continue
    grep -qF "\"$page\"" <<<"$allowed_line" \
        || fail "a jump opens \"$page\", which ShellState does not allow -- openSettings falls back to Home silently, so this reads as a right-click that goes to the wrong page"
    count=$((count + 1))
done <<<"$jumps"

# The bar is where a person looks first, and Pill has offered a right-click
# signal all along that nothing connected -- so the gesture did nothing on every
# widget in the bar. Anything built on Pill that can be configured should say so.
for widget in Clock WeatherWidget VitalsWidget StatusCluster MediaWidget; do
    file="$modules/bar/$widget.qml"
    [[ -r "$file" ]] || continue
    grep -q 'onSecondaryActivated' "$file" \
        || fail "$widget has no right-click jump; Pill routes right-click to secondaryActivated, so leaving it unconnected makes the gesture silently inert"
done

printf 'settings jump contract: PASS (%d distinct destinations)\n' "$count"