# `checks.script-test-oidc-client-secrets` — runs
# ../host-modules/lib/oidc-client-secrets.nix's `mint_client_secret` and
# `migrate_client_secret` against a stub `bao` that keeps its leaves in files
# and a stub `authelia` that prints a fixed password and digest. The cases are
# in ./oidc-client-secrets.sh.
#
# What runs is the rendered helper, sourced as the units' scripts include it,
# after the two helpers it builds on.
{
  pkgs,
  ...
}:
let
  # `login` answers from `FAKE_BAO_LOGIN_RC`. `kv get` and `kv put -cas=0` act
  # on a file per leaf under `FAKE_BAO_KV`, and answer as bao does: a missing
  # leaf is "No value found at <path>" on stderr, status 2. `FAKE_BAO_DENY_READ`
  # and `FAKE_BAO_DENY_WRITE` answer 403 as a policy that grants neither does.
  # `FAKE_BAO_RACE` has another run create the leaf between this one's read and
  # its write. Every call is logged without the value `put` reads from stdin.
  fakeBao = pkgs.writeShellScriptBin "bao" ''
    echo "$*" >> "$FAKE_BAO_LOG"
    case "$1 $2" in
      "login -method=cert")
        [ "$FAKE_BAO_LOGIN_RC" = 0 ] || { echo "fake bao: certificate refused" >&2; exit 2; }
        printf 's.fake'
        ;;
      "kv get")
        [ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
        [ "$3" = -field=value ] || { echo "fake bao: get without -field=value" >&2; exit 95; }
        leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
        [ -z "''${FAKE_BAO_DENY_READ-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
        if [ -n "''${FAKE_BAO_RACE-}" ] && [ ! -e "$FAKE_BAO_KV/.raced" ]; then
          touch "$FAKE_BAO_KV/.raced"
          printf '%s' "$FAKE_BAO_RACE" > "$leaf"
          echo "No value found at secret/data/x" >&2
          exit 2
        fi
        [ -e "$leaf" ] || { echo "No value found at secret/data/x" >&2; exit 2; }
        cat "$leaf"
        echo
        ;;
      "kv put")
        [ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
        [ "$3" = -cas=0 ] || { echo "fake bao: put without -cas=0" >&2; exit 96; }
        [ "$5" = value=- ] || { echo "fake bao: put with the value as an argument" >&2; exit 94; }
        leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
        [ -z "''${FAKE_BAO_DENY_WRITE-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
        [ ! -e "$leaf" ] || { echo "fake bao: check-and-set parameter did not match" >&2; exit 2; }
        cat > "$leaf"
        ;;
      *)
        echo "fake bao: unexpected call: $*" >&2
        exit 98
        ;;
    esac
  '';

  # Prints what `authelia crypto hash generate pbkdf2 --random` prints, or
  # nothing when `FAKE_AUTHELIA_EMPTY` is set. Every call is logged.
  fakeAuthelia = pkgs.writeShellScriptBin "authelia" ''
    echo "$*" >> "$FAKE_AUTHELIA_LOG"
    [ -z "''${FAKE_AUTHELIA_EMPTY-}" ] || exit 0
    printf 'Random Password: minted-secret\n\nDigest: $pbkdf2-sha512$fake\n'
  '';
in
pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
  {
    HELPER = pkgs.writeText "oidc-client-secrets.sh" (
      import ../host-modules/lib/store-seeded-secret.nix { }
      + import ../host-modules/lib/atomic-write-secret.nix { }
      + import ../host-modules/lib/oidc-client-secrets.nix { }
    );
    FAKE_BIN = pkgs.symlinkJoin {
      name = "fake-bao-and-authelia";
      paths = [
        fakeBao
        fakeAuthelia
      ];
    };
    nativeBuildInputs = [
      pkgs.coreutils
      pkgs.gnugrep
      pkgs.gnused
    ];
  }
  ''
    ${pkgs.bash}/bin/bash ${./oidc-client-secrets.sh}
    touch "$out"
  ''