#!/bin/sh
set -eu

repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT HUP INT TERM

snapshot_path() {
  path=$1
  if [ ! -e "$path" ] && [ ! -L "$path" ]; then
    printf 'absent\t%s\n' "$path"
    return
  fi

  # An unprivileged CI user cannot traverse every protected system root. Keep
  # a stable top-level observation for those roots instead of using sudo or
  # failing before the tests run. Readable roots are still traversed fully and
  # every readable regular file is content-hashed.
  stat --printf='top-metadata\t%F\t%a\t%u\t%g\t%N\n' -- "$path"
  if { [ -d "$path" ] && { [ ! -r "$path" ] || [ ! -x "$path" ]; }; } || \
     { [ ! -d "$path" ] && [ ! -r "$path" ]; };
  then
    printf 'unreadable\t%s\n' "$path"
    return
  fi

  traversal_complete=true
  if ! find -H "$path" -xdev \
    -exec stat --printf='metadata\t%F\t%a\t%u\t%g\t%N\n' -- {} + \
    >"$work/snapshot-metadata" 2>/dev/null
  then
    traversal_complete=false
  fi
  LC_ALL=C sort "$work/snapshot-metadata"

  if ! find -H "$path" -xdev \
    \( \( -type d \( ! -readable -o ! -executable \) \) -o \( -type f ! -readable \) \) \
    -printf='unreadable\t%p\n' >"$work/snapshot-unreadable" 2>/dev/null
  then
    traversal_complete=false
  fi
  LC_ALL=C sort "$work/snapshot-unreadable"

  if ! find -H "$path" -xdev -type f -readable -exec sha256sum -- {} + \
    >"$work/snapshot-content" 2>/dev/null
  then
    traversal_complete=false
  fi
  LC_ALL=C sort "$work/snapshot-content"

  if [ "$traversal_complete" = false ]; then
    printf 'unreadable-descendant\t%s\n' "$path"
  fi
}

snapshot() {
  for path in \
    "$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.docker/config.json" \
    /etc/apt/apt.conf.d /etc/docker/daemon.json /var/lib/proxyctl \
    /etc/systemd/system/docker.service.d
  do
    snapshot_path "$path"
  done
  if command -v gsettings >/dev/null 2>&1; then
    gsettings list-recursively org.gnome.system.proxy 2>&1 || true
  else
    printf 'gsettings absent\n'
  fi
  if command -v systemctl >/dev/null 2>&1; then
    systemctl show docker.service -p ActiveState -p SubState -p NRestarts -p ExecMainStartTimestampMonotonic 2>&1 || true
  else
    printf 'systemctl absent\n'
  fi
}

snapshot >"$work/before"
(
  cd "$repo"
  go test -count=1 ./...
)
snapshot >"$work/after"
cmp "$work/before" "$work/after"
printf 'full Go suite passed unprivileged: readable host configuration content and metadata were unchanged; protected roots retained the same top metadata and unreadable markers; no sudo was used\n'