#!/usr/bin/env bash
set -Eeuo pipefail
umask 077

WRAPPER="${ROUTER_MACHINE_CLOSE_WRAPPER_UNDER_TEST:-/opt/router-ops/bin/router-machine-close}"
LIBRARY="${ROUTER_MACHINE_CLOSE_LIBRARY_UNDER_TEST:-/opt/router-ops/lib/router-machine-close-contract.sh}"
WORK="$(mktemp -d /tmp/router-machine-close-contract-selftest.XXXXXX)"
trap 'rm -rf "$WORK"' EXIT

BASE="$WORK/base"
TOKEN="synthetic-token"
PUBLIC_BASE="https://reports.secret-studio.ru"
STATE_FILE="$BASE/state/current-vm101-git-source.env"
TOKEN_FILE="$BASE/public/.router-public-token"
REINDEX="$WORK/reindex"
RUN_ROOT="$WORK/runs"
mkdir -p "$BASE/bin" "$BASE/lib" "$BASE/state" "$BASE/public/r/$TOKEN/latest" "$RUN_ROOT"
printf '%s\n' "$TOKEN" > "$TOKEN_FILE"
cat > "$REINDEX" <<'SH'
#!/usr/bin/env bash
exit 0
SH
chmod 700 "$REINDEX"

write_pass_evidence() {
    local folder="$1"
    local dir="$BASE/public/r/$TOKEN/latest/$folder"
    local url="$PUBLIC_BASE/latest/$folder/"
    mkdir -p "$dir"
    cat > "$STATE_FILE" <<EOF_STATE
VM101_GIT_SOURCE_UPDATED_AT_UTC=20260716-000000
VM101_GIT_SOURCE_REPOSITORY=https://github.com/DChuvelev/wg-paid-vm101.git
VM101_GIT_SOURCE_BRANCH=main
VM101_GIT_SOURCE_COMMIT=1111111111111111111111111111111111111111
VM101_GIT_SOURCE_TREE=2222222222222222222222222222222222222222
VM101_GIT_SOURCE_FILE_COUNT=32
VM101_GIT_SOURCE_PUBLIC_DIR=$dir
VM101_GIT_SOURCE_URL=$url
EOF_STATE
    cat <<EOF_OUT
RESULT=PASS_vm101_GIT_PUBLISH
VM130_STATUS=CLEAN
PUBLISHED_DIR=$dir
PUBLISHED_RELATIVE_PATH=latest/$folder
PUBLIC_OBJECT_KIND=vm101
PREVIOUS_MOVED_COUNT=1
LATEST_INDEX_CONTAINS_FOLDER=true
HTTP_POSTCHECK=PASS
VM101_PUBLIC_URL=$url
VM101_GIT_SOURCE_COMMIT=1111111111111111111111111111111111111111
VM101_GIT_SOURCE_TREE=2222222222222222222222222222222222222222
VM101_GIT_SOURCE_FILE_COUNT=32
VM101_GIT_SOURCE_URL=$url
PERMANENT_HTTPS_PUBLISHED=true
EOF_OUT
}

make_backend() {
    local name="$1" mode="$2" rc="$3"
    cat > "$WORK/$name" <<EOF_BACKEND
#!/usr/bin/env bash
set -u
BASE="\${ROUTER_OPS_BASE:?}"
PUBLIC_BASE="\${ROUTER_PUBLIC_BASE_URL:?}"
TOKEN="\$(cat "\${ROUTER_PUBLIC_TOKEN_FILE:?}")"
STATE_FILE="\${ROUTER_MACHINE_CLOSE_STATE_FILE_OVERRIDE:?}"
case "$mode" in
pass)
    $(declare -f write_pass_evidence)
    write_pass_evidence "20260716-000000_vm101_git_source_deadbeef"
    ;;
backend_stop)
    echo RESULT=STOP_SYNTHETIC_BACKEND
    ;;
signal_timeout)
    echo SYNTHETIC_TIMEOUT=true
    ;;
publication_stop)
    $(declare -f write_pass_evidence)
    write_pass_evidence "20260716-000000_vm101_git_source_deadbeef"
    echo RESULT=STOP_SYNTHETIC_PUBLICATION
    ;;
check_pass)
    echo RESULT=PASS_VM130_VM101_GIT_SOURCE_CHECK
    ;;
esac
exit $rc
EOF_BACKEND
    chmod 700 "$WORK/$name"
}

make_backend pass_rc0 pass 0
make_backend pass_rc1 pass 1
make_backend backend_stop backend_stop 1
make_backend signal_timeout signal_timeout 124
make_backend publication_pass pass 0
make_backend publication_stop publication_stop 1
make_backend check_pass check_pass 0

run_case() {
    local name="$1" expected="$2" mode="${3:---publish}"
    local log="$WORK/$name.log" rc
    rm -f "$STATE_FILE"
    rm -rf "$BASE/public/r/$TOKEN/latest"/*

    set +e
    (
        export ROUTER_OPS_BASE="$BASE"
        export ROUTER_PUBLIC_BASE_URL="$PUBLIC_BASE"
        export ROUTER_PUBLIC_TOKEN_FILE="$TOKEN_FILE"
        export ROUTER_MACHINE_CLOSE_BACKEND_OVERRIDE="$WORK/$name"
        export ROUTER_MACHINE_CLOSE_STATE_FILE_OVERRIDE="$STATE_FILE"
        export ROUTER_MACHINE_CLOSE_REINDEX_OVERRIDE="$REINDEX"
        export ROUTER_MACHINE_CLOSE_CONTRACT_LIB_OVERRIDE="$LIBRARY"
        export ROUTER_MACHINE_CLOSE_RUN_ROOT_OVERRIDE="$RUN_ROOT"
        if [[ "$mode" == "--check" ]]; then
            "$WRAPPER" --check vm101 "SYNTHETIC: $name"
        else
            "$WRAPPER" vm101 "SYNTHETIC: $name"
        fi
    ) >"$log" 2>&1
    rc=$?
    set -e

    if [[ "$expected" == pass ]]; then
        [[ "$rc" -eq 0 ]]
        grep -Eq '^RESULT=PASS_ROUTER_MACHINE_CLOSE(_CHECK)?$' "$log"
        ! grep -Eq '^RESULT=STOP_|^STOP=' "$log"
    else
        [[ "$rc" -ne 0 ]]
        grep -Eq '^RESULT=STOP_ROUTER_MACHINE_CLOSE' "$log"
    fi
    echo "CASE=$name EXPECTED=$expected ACTUAL_RC=$rc PASS=true"
}

run_case pass_rc0 pass
run_case pass_rc1 pass
run_case backend_stop stop
run_case signal_timeout stop
run_case publication_pass pass
run_case publication_stop stop
run_case check_pass pass --check

grep -qx 'BACKEND_RC_NONZERO_SALVAGED=true' "$WORK/pass_rc1.log"
grep -qx 'CLASSIFICATION=PASS_AUTHORITATIVE_EVIDENCE_DESPITE_BACKEND_RC' "$WORK/pass_rc1.log"

echo RESULT=PASS_ROUTER_MACHINE_CLOSE_CONTRACT_SELFTEST
