#!/usr/bin/env sh
set -eu

ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
HELPER="$ROOT/scripts/modelforge_scheduled_backup.sh"
TEMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TEMP_DIR"' EXIT HUP INT TERM
mkdir -p "$TEMP_DIR/bin"

cat >"$TEMP_DIR/bin/curl" <<'CURL'
#!/usr/bin/env sh
set -eu
expected="${MODELFORGE_TEST_EXPECTED_KEY:?test did not provide an expected credential}"
found=false
for argument do
  if [ "$argument" = "X-ModelForge-Admin-Token: $expected" ]; then
    found=true
  fi
done
if [ "$found" != true ]; then
  printf '%s\n' 'scheduled backup sent the wrong admin credential' >&2
  exit 97
fi

case " $* " in
  *"/verify "*)
    printf '%s\n' verify >>"$MODELFORGE_TEST_CURL_CALLS"
    printf '%s' '{"state":"VERIFIED"}'
    ;;
  *"/retention/run "*)
    printf '%s\n' retention >>"$MODELFORGE_TEST_CURL_CALLS"
    ;;
  *"/recovery/backups "*)
    printf '%s\n' create >>"$MODELFORGE_TEST_CURL_CALLS"
    printf '%s' '{"id":"00000000-0000-0000-0000-000000000001","state":"CREATED"}'
    ;;
  *)
    printf '%s\n' 'scheduled backup sent an unexpected request' >&2
    exit 98
    ;;
esac
CURL
chmod +x "$TEMP_DIR/bin/curl"

assert_calls() {
  expected_calls="$1"
  actual_calls="$(cat "$TEMP_DIR/calls")"
  if [ "$actual_calls" != "$expected_calls" ]; then
    printf 'expected API calls:\n%s\nactual API calls:\n%s\n' "$expected_calls" "$actual_calls" >&2
    return 1
  fi
}

assert_secret_not_logged() {
  secret="$1"
  if grep -F "$secret" "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >/dev/null 2>&1; then
    printf '%s\n' 'scheduled backup printed a credential to its output' >&2
    return 1
  fi
}

: >"$TEMP_DIR/calls"
if ! MODELFORGE_BACKUP_ADMIN_API_KEY=dedicated-named-admin-secret \
  MODELFORGE_OPERATOR_API_KEY=legacy-global-secret \
  MODELFORGE_TEST_EXPECTED_KEY=dedicated-named-admin-secret \
  MODELFORGE_TEST_CURL_CALLS="$TEMP_DIR/calls" \
  PATH="$TEMP_DIR/bin:$PATH" sh "$HELPER" >"$TEMP_DIR/stdout" 2>"$TEMP_DIR/stderr"; then
  cat "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >&2
  printf '%s\n' 'scheduled backup rejected its dedicated named administrator key' >&2
  exit 1
fi
assert_calls 'create
verify
retention'
assert_secret_not_logged dedicated-named-admin-secret

: >"$TEMP_DIR/calls"
if ! MODELFORGE_OPERATOR_API_KEY=legacy-global-secret \
  MODELFORGE_TEST_EXPECTED_KEY=legacy-global-secret \
  MODELFORGE_TEST_CURL_CALLS="$TEMP_DIR/calls" \
  PATH="$TEMP_DIR/bin:$PATH" sh "$HELPER" >"$TEMP_DIR/stdout" 2>"$TEMP_DIR/stderr"; then
  cat "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >&2
  printf '%s\n' 'scheduled backup no longer accepts the legacy administrator key' >&2
  exit 1
fi
assert_calls 'create
verify
retention'
assert_secret_not_logged legacy-global-secret

: >"$TEMP_DIR/calls"
set +e
env -u MODELFORGE_BACKUP_ADMIN_API_KEY -u MODELFORGE_OPERATOR_API_KEY \
  MODELFORGE_TEST_CURL_CALLS="$TEMP_DIR/calls" PATH="$TEMP_DIR/bin:$PATH" \
  sh "$HELPER" >"$TEMP_DIR/stdout" 2>"$TEMP_DIR/stderr"
missing_key_status=$?
set -e
if [ "$missing_key_status" -eq 0 ] || [ -s "$TEMP_DIR/calls" ]; then
  printf '%s\n' 'scheduled backup did not fail closed before making an API call' >&2
  cat "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >&2
  exit 1
fi
if ! grep -F 'MODELFORGE_BACKUP_ADMIN_API_KEY' "$TEMP_DIR/stderr" >/dev/null 2>&1; then
  printf '%s\n' 'missing-key diagnostic did not name the dedicated setting' >&2
  cat "$TEMP_DIR/stderr" >&2
  exit 1
fi

printf '%s\n' 'scheduled backup authentication tests passed'