#!/bin/sh
set -eu

repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT HUP INT TERM
home="$work/home"
config="$work/config"
state="$work/state"
bin="$work/bin"
mkdir -p "$home" "$config" "$state" "$bin"

snapshot_host_path() {
  path=$1
  if [ ! -e "$path" ] && [ ! -L "$path" ]; then
    printf 'absent\t%s\n' "$path"
    return
  fi

  stat --printf='top-metadata\t%F\t%a\t%u\t%g\t%N\n' -- "$path"
  if { [ -d "$path" ] && { [ ! -r "$path" ] || [ ! -x "$path" ]; }; } || \
     { [ ! -d "$path" ] && [ ! -r "$path" ]; };
  then
    printf 'unreadable\t%s\n' "$path"
    return
  fi

  traversal_complete=true
  if ! find -H "$path" -xdev \
    -exec stat --printf='metadata\t%F\t%a\t%u\t%g\t%N\n' -- {} + \
    >"$work/host-snapshot-metadata" 2>/dev/null
  then
    traversal_complete=false
  fi
  LC_ALL=C sort "$work/host-snapshot-metadata"

  if ! find -H "$path" -xdev \
    \( \( -type d \( ! -readable -o ! -executable \) \) -o \( -type f ! -readable \) \) \
    -printf='unreadable\t%p\n' >"$work/host-snapshot-unreadable" 2>/dev/null
  then
    traversal_complete=false
  fi
  LC_ALL=C sort "$work/host-snapshot-unreadable"

  if ! find -H "$path" -xdev -type f -readable -exec sha256sum -- {} + \
    >"$work/host-snapshot-content" 2>/dev/null
  then
    traversal_complete=false
  fi
  LC_ALL=C sort "$work/host-snapshot-content"

  if [ "$traversal_complete" = false ]; then
    printf 'unreadable-descendant\t%s\n' "$path"
  fi
}

snapshot_host() {
  for path in \
    "$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.docker/config.json" \
    /etc/apt/apt.conf.d /etc/docker/daemon.json /var/lib/proxyctl \
    /etc/systemd/system/docker.service.d
  do
    snapshot_host_path "$path"
  done
  if command -v gsettings >/dev/null 2>&1; then
    gsettings get org.gnome.system.proxy mode 2>&1 || true
  else
    printf 'gsettings absent\n'
  fi
}

snapshot_host >"$work/host-before"

(
  cd "$repo"
  GOFLAGS='-mod=readonly' GOBIN="$bin" go install ./cmd/proxyctl
)
test "$("$bin/proxyctl" version --short)" != ""
mv "$bin/proxyctl" "$bin/proxyctl-production"
(
  cd "$repo"
  GOFLAGS='-mod=readonly -tags=proxyctl_process_test' GOBIN="$bin" go install ./cmd/proxyctl
  go test ./internal/app -run 'TestUserCanCreateAndActivatePersistentSingleProxyProfile|TestApplicationCoordinatesMultipleRealAndFakeHermeticAdaptersThroughPartialFailure' -count=1
)

env_run() {
  env -i \
    PATH="$PATH" HOME="$home" XDG_CONFIG_HOME="$config" XDG_STATE_HOME="$state" \
    SHELL=/bin/bash PROXYCTL_PROCESS_TEST_HOME="$home" \
    "$bin/proxyctl" "$@"
}

test "$(env_run version --short)" != ""
doctor_output=$(env_run doctor 2>&1 || true)
printf '%s\n' "$doctor_output" | grep -q 'Profile validity'
printf 'no\n' | env_run reset | grep -q 'Reset cancelled'
printf 'yes\n' | env_run reset | grep -q 'shell: skipped (Disabled)'
env_run shell install | grep -q 'installed'
grep -q 'proxyctl shell integration' "$home/.bashrc"
env_run shell uninstall | grep -q 'uninstalled'
if grep -q 'proxyctl shell integration' "$home/.bashrc"; then
  echo 'Shell integration remained after uninstall' >&2
  exit 1
fi

rm "$bin/proxyctl" "$bin/proxyctl-production"
test ! -e "$bin/proxyctl"
test ! -e "$bin/proxyctl-production"
snapshot_host >"$work/host-after"
cmp "$work/host-before" "$work/host-after"

printf 'clean-machine verification passed: go install, Profile workflow, hermetic Target workflow, doctor, reset cancellation/confirmation, Shell install/uninstall, binary removal, and unchanged host state\n'