# Cases for ./store-seeded-secret.nix. Each case sets up the store's leaf, the
# earlier file and the stub's behaviour, runs `store_seeded` under `set -e` as
# the callers' scripts do, and compares its exit status, its output, what the
# store holds afterwards and whether the mint command ran.
set -uo pipefail

failures=0
count=0

fail() {
  echo "FAILED: $case: $*" >&2
  failures=$((failures + 1))
}

leaf=secret/swarm/services/t/keys/k
pem=$'-----BEGIN PRIVATE KEY-----\nMIIfake\nline2\n-----END PRIVATE KEY-----'

# setup <description>
setup() {
  case=$1
  count=$((count + 1))
  dir=$(mktemp -d)
  mkdir "$dir/kv"
  export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
  unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE
  : >"$FAKE_BAO_LOG"
  earlier=$dir/earlier
  minted=$dir/minted
  stored=$FAKE_BAO_KV/$(printf '%s' "$leaf" | tr / _)
}

mint() {
  echo run >>"$minted"
  printf 'minted-value\n'
}

# run — `store_seeded` for $leaf and $earlier with the stub first on PATH.
# Sets $rc and $got.
run() {
  got=$(
    set -e
    PATH="$FAKE_BAO_BIN:$PATH"
    unset BAO_TOKEN
    # shellcheck source=/dev/null
    . "$HELPER"
    store_init
    store_login 2>>"$dir/err"
    store_seeded "$leaf" "$earlier" mint 2>"$dir/err"
  )
  rc=$?
}

# expect <status> <output>
expect() {
  if [ "$rc" != "$1" ]; then fail "exited $rc, wanted $1: $(cat "$dir/err")"; fi
  if [ "$got" != "$2" ]; then fail "printed '$got', wanted '$2'"; fi
}

# held <value>, or held "" for a leaf the store does not have.
held() {
  if [ -z "$1" ]; then
    if [ -e "$stored" ]; then fail "the store holds '$(cat "$stored")', wanted nothing"; fi
  elif [ "$(cat "$stored" 2>/dev/null)" != "$1" ]; then
    fail "the store holds '$(cat "$stored" 2>/dev/null)', wanted '$1'"
  fi
}

ran_mint() {
  [ -s "$minted" ]
}

setup "an empty store is seeded from the file, unchanged, and nothing is minted"
printf 'old-value\n' >"$earlier"
run
expect 0 old-value
held old-value
if ran_mint; then fail "minted although the file held a value"; fi
if ! grep -q '^kv put -cas=0 ' "$FAKE_BAO_LOG"; then fail "no create-only write was made"; fi

setup "a multi-line file is seeded unchanged"
printf '%s\n' "$pem" >"$earlier"
run
expect 0 "$pem"
held "$pem"

setup "the store's value wins over the file and is not written over"
printf 'stored-value' >"$stored"
printf 'old-value\n' >"$earlier"
run
expect 0 stored-value
held stored-value
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
if ran_mint; then fail "minted although the store held a value"; fi

setup "the store's value is used when there is no file"
printf 'stored-value' >"$stored"
run
expect 0 stored-value
if ran_mint; then fail "minted although the store held a value"; fi

setup "a value is minted into the store when neither holds one"
run
expect 0 minted-value
held minted-value
if ! ran_mint; then fail "did not mint"; fi

setup "a run that loses the race takes the winner's value, not its own seed"
printf 'old-value\n' >"$earlier"
export FAKE_BAO_RACE=winner-value
run
expect 0 winner-value
held winner-value

setup "a store that grants neither read nor write leaves the file's value in use"
printf 'old-value\n' >"$earlier"
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
run
expect 0 old-value
held ""
if ran_mint; then fail "minted although the file held a value"; fi

setup "a store that grants neither, and no file, gives no value and mints nothing into it"
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
run
expect 1 ""
held ""

setup "a store that refuses the login leaves the file's value in use and is not called again"
printf 'old-value\n' >"$earlier"
export FAKE_BAO_LOGIN_RC=1
run
expect 0 old-value
if grep -q '^kv' "$FAKE_BAO_LOG"; then fail "called kv after a refused login"; fi

setup "a store that refuses the login, and no file, gives no value"
export FAKE_BAO_LOGIN_RC=1
run
expect 1 ""
if ran_mint; then fail "minted with no store to hold the value"; fi

if [ "$failures" != 0 ]; then
  echo "$failures of $count cases failed" >&2
  exit 1
fi
echo "$count cases passed"