# `checks.script-test-granter-login` — runs ../host-modules/lib/granter-login.nix
# against a stub `bao` whose login and status answers are set per case. The
# cases are in ./granter-login.sh and the stub is ./granter-login-fake-bao.sh.
#
# What runs is the rendered login, with the same `baoStoreUp` text the unit
# passes, rendered once with the bootstrap-token hint and once without. The
# bootstrap token's `auth list` step (../host-modules/lib/bootstrap-auth-list.nix)
# is rendered the same way and run against the same stub.
{
  pkgs,
  ...
}:
let
  render =
    haveBootstrapToken:
    pkgs.writeText "granter-login.sh" (
      import ../host-modules/lib/granter-login.nix {
        inherit (pkgs) lib;
        granterCn = "bao-granter";
        granterPolicyName = "bao-granter";
        inherit haveBootstrapToken;
        baoStoreUp = ''HOME=/var/empty bao status >/dev/null 2>>"$err"'';
        setupSteps = [ "bao policy write bao-bootstrap /etc/bootstrap.hcl" ];
      }
    );

  fakeBao = pkgs.runCommand "fake-bao" { } ''
    install -Dm755 ${./granter-login-fake-bao.sh} $out/bin/bao
    patchShebangs $out/bin
  '';
in
pkgs.runCommand "hyperhive-script-test-granter-login"
  {
    LOGIN = render false;
    LOGIN_WITH_TOKEN = render true;
    BOOTSTRAP_LIST = pkgs.writeText "bootstrap-auth-list.sh" (
      import ../host-modules/lib/bootstrap-auth-list.nix {
        inherit (pkgs) lib;
        bootstrapTokenFile = "/tmp/granter-bootstrap-test.token";
        granterClientCertFile = "/nonexistent/granter.crt";
        granterClientKeyFile = "/nonexistent/granter.key";
        baoStoreUp = ''HOME=/var/empty bao status >/dev/null 2>>"$err"'';
        setupSteps = [ "bao policy write bao-bootstrap /etc/bootstrap.hcl" ];
      }
    );
    FAKE_BAO_BIN = "${fakeBao}/bin";
    nativeBuildInputs = [
      pkgs.coreutils
      pkgs.gnugrep
    ];
  }
  ''
    ${pkgs.bash}/bin/bash ${./granter-login.sh}
    touch "$out"
  ''