# Cases for ./nats-render-config.nix. Each case gets a fresh runtime directory,
# runs the rendered script against it, and asserts on the exit code and the
# config files left behind.
set -uo pipefail

failures=0
count=0

fail() {
  echo "FAILED: $case: $*" >&2
  failures=$((failures + 1))
}

# The shapes the script checks for: the key type's letter and 55 base32
# characters.
key=XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
issuer=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
user=UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

setup() {
  case=$1
  dir=$(mktemp -d)
  rt=$dir/rt
  mkdir "$rt"
  if ! sed "s|^d=.*|d=$rt|" "$RENDER" >"$dir/render"; then
    echo "cannot read the rendered script $RENDER" >&2
    exit 1
  fi
  chmod +x "$dir/render"
  if ! grep -qxF "d=$rt" "$dir/render"; then fail "the rewrite did not reach the script's runtime directory"; fi
}

# All three public keys, as the fetch unit leaves them.
fetched() {
  printf '%s\n' "$key" >"$rt/callout-xkey.pub"
  printf '%s\n' "$issuer" >"$rt/issuer.pub"
  printf '%s\n' "$user" >"$rt/callout-user.pub"
}

go() {
  count=$((count + 1))
  "$dir/render" >"$dir/out" 2>"$dir/err"
  rc=$?
}

refused() {
  go
  if [ "$rc" -eq 0 ]; then fail "exited 0"; fi
  if [ -e "$rt/callout.conf" ] || [ -e "$rt/nats.conf" ]; then fail "a config was written"; fi
}

setup "the fetched keys are rendered into auth_callout and the callout account, and the server's config includes them"
fetched
go
if [ "$rc" -ne 0 ]; then fail "exit $rc: $(cat "$dir/err")"; fi
if ! jq -e --arg k "$key" '.authorization.auth_callout.xkey == $k' "$rt/callout.conf" >/dev/null; then
  fail "callout.conf does not carry the xkey as auth_callout.xkey"
fi
if ! jq -e --arg k "$issuer" '.authorization.auth_callout.issuer == $k' "$rt/callout.conf" >/dev/null; then
  fail "callout.conf does not carry the issuer key as auth_callout.issuer"
fi
if ! jq -e --arg k "$user" '.authorization.auth_callout.auth_users == [$k] and .accounts.AUTH.users == [{nkey: $k}]' "$rt/callout.conf" >/dev/null; then
  fail "callout.conf does not carry the user key as the one exempt user and the callout account's one member"
fi
if ! grep -qxF 'include "callout.conf"' "$rt/nats.conf"; then fail "nats.conf does not include callout.conf"; fi

setup "with no key file the start fails and writes no config"
refused

for file in callout-xkey.pub issuer.pub callout-user.pub; do
  setup "with no $file the start fails and writes no config"
  fetched
  rm "$rt/$file"
  refused

  setup "a $file that is not its kind of public key fails the start and writes no config"
  fetched
  printf '%s' "not-a-key" >"$rt/$file"
  refused
done

# Each key in the other's file: right shape, wrong letter.
setup "an issuer key where the user key belongs fails the start and writes no config"
fetched
printf '%s' "$issuer" >"$rt/callout-user.pub"
refused

if [ "$failures" -ne 0 ]; then
  echo "script-test-nats-render-config: $failures of $count cases broke" >&2
  exit 1
fi
echo "$count cases hold in script-test-nats-render-config"