#!/usr/bin/env bash
set -euo pipefail

readonly PROJECT_DIRECTORY=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
readonly VERSION=${VERSION:-0.8.0-rc1}
readonly INSTALLER=${1:-$PROJECT_DIRECTORY/dist/cfpp-unified-install-v$VERSION.sh}
readonly WORK_DIRECTORY=$(mktemp -d /tmp/cfpp-installer-test.XXXXXX)
cleanup() { find "$WORK_DIRECTORY" -depth -delete 2>/dev/null || true; }
trap cleanup EXIT
fail() { printf '%s\n' "$*" >&2; exit 1; }

[[ -x $INSTALLER ]] || fail "installer is not executable: $INSTALLER"
[[ -r $INSTALLER.sha256 ]] || fail 'installer checksum sidecar is missing'
(cd "$(dirname -- "$INSTALLER")" && sha256sum --check "$(basename -- "$INSTALLER").sha256")
marker_line=$(awk '$0=="__CFPP_ARCHIVE_BELOW__" {print NR;exit}' "$INSTALLER")
[[ $marker_line =~ ^[0-9]+$ ]] || fail 'archive marker is missing'
[[ $(grep -c '^__CFPP_ARCHIVE_BELOW__$' "$INSTALLER") == 1 ]] || fail 'archive marker is not unique'
head -n "$((marker_line-1))" "$INSTALLER" >"$WORK_DIRECTORY/header.sh"
bash -n "$WORK_DIRECTORY/header.sh"
for ceiling in 1 32768 500000; do CFPP_MAX_CONNECTIONS=$ceiling bash "$INSTALLER" --help >/dev/null; done
CFPP_MAX_CONNECTIONS=32768 sh "$INSTALLER" --help >/dev/null
for ceiling in 0 500001 -1 00 abc 18446744073709551617; do
  if CFPP_MAX_CONNECTIONS=$ceiling bash "$INSTALLER" --help >"$WORK_DIRECTORY/invalid-ceiling" 2>&1; then fail "invalid connection ceiling accepted: $ceiling"; fi
done

tail -n "+$((marker_line+1))" "$INSTALLER" | base64 --decode >"$WORK_DIRECTORY/payload.tar.gz"
expected_payload=$(awk -F'"' '/^readonly PAYLOAD_SHA256=/ {print $2;exit}' "$INSTALLER")
actual_payload=$(sha256sum "$WORK_DIRECTORY/payload.tar.gz" | awk '{print $1}')
[[ $expected_payload == "$actual_payload" ]] || fail 'payload checksum mismatch'
# This delivery is flat. Reject unsafe archive paths and links before extraction.
python3 - "$WORK_DIRECTORY/payload.tar.gz" <<'PYARCHIVE'
from pathlib import PurePosixPath
import sys,tarfile
with tarfile.open(sys.argv[1]) as archive:
    for entry in archive.getmembers():
        path=PurePosixPath(entry.name)
        assert not path.is_absolute() and '..' not in path.parts,entry.name
        assert len(path.parts)<=1,entry.name
        assert entry.isfile() or (entry.isdir() and entry.name in ('.','./')),entry.name
PYARCHIVE
mkdir "$WORK_DIRECTORY/payload"
tar -C "$WORK_DIRECTORY/payload" -xzf "$WORK_DIRECTORY/payload.tar.gz"
(cd "$WORK_DIRECTORY/payload" && sha256sum --check SHA256SUMS >/dev/null)
python3 - "$WORK_DIRECTORY/payload" <<'PYMANIFEST'
from pathlib import Path
import sys
root=Path(sys.argv[1]); records=[]
for row in (root/'SHA256SUMS').read_text().splitlines():
    digest,name=row.split(maxsplit=1)
    if name.startswith('*'):name=name[1:]
    if name.startswith('./'):name=name[2:]
    assert len(digest)==64 and '/' not in name and name not in ('','SHA256SUMS'),row
    records.append(name)
assert len(records)==len(set(records)),'duplicate manifest entries'
actual={p.name for p in root.iterdir() if p.is_file() and p.name!='SHA256SUMS'}
assert set(records)==actual,set(records)^actual
PYMANIFEST
file "$WORK_DIRECTORY/payload/cf-pp-gateway" | grep -q 'ELF 64-bit.*x86-64'
for name in cfppctl network-common network-apply network-check network-remove network-diagnose network-reconcile uninstall.sh; do
  [[ -x $WORK_DIRECTORY/payload/$name ]] || fail "missing executable: $name"
  bash -n "$WORK_DIRECTORY/payload/$name"
done
for name in topology-plan.py cf-pp-gateway.service cf-pp-gateway-legacy.service cf-pp-gateway-network.service cf-pp-gateway-reconcile.service cf-pp-gateway-reconcile.timer capacity-500k.conf; do
  [[ -r $WORK_DIRECTORY/payload/$name ]] || fail "missing payload file: $name"
done
python3 - "$WORK_DIRECTORY/payload/topology-plan.py" <<'PYSYNTAX'
from pathlib import Path
import sys
p=Path(sys.argv[1]);compile(p.read_text(),str(p),'exec')
PYSYNTAX
bash "$WORK_DIRECTORY/payload/cfppctl" --help >/dev/null
python3 "$WORK_DIRECTORY/payload/topology-plan.py" --help >/dev/null

grep -Fq 'readonly INSTALLER_MODE="embedded"' "$WORK_DIRECTORY/header.sh"
grep -Fq 'readonly INSTALLER_VERSION="'"$VERSION"'"' "$WORK_DIRECTORY/header.sh"
grep -Fq 'TARGET_MAX_CONNECTIONS=${CFPP_MAX_CONNECTIONS:-32768}' "$WORK_DIRECTORY/header.sh"
grep -Fq '"$PAYLOAD_DIRECTORY/topology-plan.py"' "$WORK_DIRECTORY/header.sh"
grep -q 'TARGET_INGRESS_INTERFACES=' "$WORK_DIRECTORY/header.sh"
grep -Fq 'CFPP_INGRESS_INTERFACES="%s"' "$WORK_DIRECTORY/header.sh"
grep -Fq 'bash "$PAYLOAD_DIRECTORY/cfppctl" check' "$WORK_DIRECTORY/header.sh"
grep -Fq 'bash "$PAYLOAD_DIRECTORY/cfppctl" upgrade' "$WORK_DIRECTORY/header.sh"
grep -Fq 'TARGET_MAX_CONNECTIONS * 4 + 4096' "$WORK_DIRECTORY/header.sh"
grep -q '^rollback() {' "$WORK_DIRECTORY/header.sh"
grep -q 'backup_items=()' "$WORK_DIRECTORY/header.sh"
grep -q 'installation failed; restoring the previous gateway state' "$WORK_DIRECTORY/header.sh"
grep -Fq 'systemctl enable --now cf-pp-gateway-reconcile.timer' "$WORK_DIRECTORY/header.sh"
grep -q '^CFPP_CAPTURE_PORTS=1:65535$' "$WORK_DIRECTORY/payload/network.env"
grep -Fq 'for interface in "${CFPP_INGRESS_DEVICES[@]}"' "$WORK_DIRECTORY/payload/network-apply"
grep -Fq -- '--match-set "$CFPP_DESTINATION_V4_SET" dst' "$WORK_DIRECTORY/payload/network-apply"
grep -Fq -- '-j DNAT --to-destination "$CFPP_INGRESS_ADDRESS:$CFPP_INGRESS_PORT"' "$WORK_DIRECTORY/payload/network-apply"
grep -Fq 'max_connections_default=32768' "$WORK_DIRECTORY/payload/BUILD-INFO.txt"
grep -Fq 'all-global-ipv4-on-selected-ingress-interfaces' "$WORK_DIRECTORY/payload/BUILD-INFO.txt"
grep -Fq 'network-helper-upgrade-preserve-config-and-main-daemon' "$WORK_DIRECTORY/payload/BUILD-INFO.txt"
grep -Fq 'release_validation=linux-kernel-docker-upstream-tests-required' "$WORK_DIRECTORY/payload/BUILD-INFO.txt"
if grep -Eq '156\.246\.(69|70|71)' "$WORK_DIRECTORY/header.sh" "$WORK_DIRECTORY/payload/config.json"; then fail 'hard-coded deployment address remains'; fi
python3 - "$WORK_DIRECTORY/payload/config.json" <<'PYCONFIG'
from pathlib import Path
import json,sys
s=Path(sys.argv[1]).read_text().replace('@@ORIGIN_IP@@','203.0.113.10')
s=s.replace('@@ALLOWED_PROXY_DESTINATIONS@@','    "203.0.113.10",\n    "203.0.113.11"')
assert '@@' not in s
config=json.loads(s)
assert config['allowed_proxy_destinations']==['203.0.113.10','203.0.113.11']
assert config['listeners'][0]['listen']=='203.0.113.10:39000'
assert config['listeners'][0]['missing_proxy_policy']=='passthrough-original'
assert config['max_connections']==32768
PYCONFIG
printf 'unified one-click installer verification passed; Linux network and customer-login tests are separate\n'
