#!/usr/bin/env bash
# Self-contained checks for the policy parsing guards in probe-member-credentials.sh.

set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
PROBE="$ROOT/scripts/probe-member-credentials.sh"
TMP="$(mktemp -d "$ROOT/.probe-member-credentials-test.XXXXXX")"
trap 'rm -rf "$TMP"' EXIT

# The SOURCED guard exposes this pure parser without contacting POLICY_URL.
source "$PROBE"

fail() {
  printf 'FAIL: %s\n' "$*" >&2
  return 1
}

assert_equals() {
  local expected="$1" actual="$2" description="$3"
  [ "$expected" = "$actual" ] || fail "$description: expected $expected, got $actual"
}

assert_contains() {
  local needle="$1" text="$2" description="$3"
  printf '%s' "$text" | grep -qF "$needle" || fail "$description: missing $needle"
}

make_jq() {
  local body="$1"
  mkdir -p "$TMP/bin"
  printf '%s\n' '#!/usr/bin/env bash' "$body" > "$TMP/bin/jq"
  chmod +x "$TMP/bin/jq"
}

run_parser() {
  local output rc=0
  POLICY_JSON="$(< "$TMP/policy.json")"
  POLICY_URL="fixture://member-credentials"
  output="$(PATH="$TMP/bin:$PATH" parse_policy_fields 2>&1)" || rc=$?
  PARSER_OUTPUT="$output"
  PARSER_RC="$rc"
}

test_bash_older_than_four_refuses() {
  local output rc=0 version
  version="$(/bin/bash -c 'printf %s "$BASH_VERSION"')"
  output="$(/bin/bash "$PROBE" 2>&1)" || rc=$?
  assert_equals 3 "$rc" "bash 3 refusal status"
  assert_contains 'This shell is bash' "$output" "bash 3 refusal"
  assert_contains "$version" "$output" "bash 3 refusal version"
}

test_parser_non_zero_refuses() {
  make_jq 'exit 17'
  run_parser
  assert_equals 4 "$PARSER_RC" "parser failure status"
  assert_contains 'jq exited non-zero (status 17)' "$PARSER_OUTPUT" "parser failure message"
}

test_short_parser_output_refuses() {
  make_jq "printf '%s\\n' true enforce 3 2"
  run_parser
  assert_equals 5 "$PARSER_RC" "short parser output status"
  assert_contains 'policy parser (jq) returned 4 field(s)' "$PARSER_OUTPUT" "short parser output count"
}

test_empty_parser_output_reports_zero_fields() {
  make_jq ':'
  run_parser
  assert_equals 5 "$PARSER_RC" "empty parser output status"
  assert_contains 'policy parser (jq) returned 0 field(s)' "$PARSER_OUTPUT" "empty parser output count"
}

test_well_formed_policy_prints_name_table() {
  local output rc=0
  make_jq "cat '$TMP/policy.fields'"
  # Shell functions cannot be passed in an environment assignment. Run the executable through bash.
  output="$(BRIDGED_MEMBER=1 FIXTURE="$TMP/policy.json" PROBE="$PROBE" PATH="$TMP/bin:$PATH" bash -c '
    curl() { cat "$FIXTURE"; }
    export -f curl
    exec "$PROBE"
  ' 2>&1)" || rc=$?
  assert_equals 0 "$rc" "well-formed policy status"
  assert_contains 'ALPHA_TOKEN' "$output" "name table"
  assert_contains 'BETA_TOKEN' "$output" "name table"
  assert_contains 'GAMMA_TOKEN' "$output" "name table"
}

cat > "$TMP/policy.json" <<'JSON'
{"present":true,"policy":"enforce","knownCount":3,"allowedCount":2,"blockedCount":1,"known":["ALPHA_TOKEN","BETA_TOKEN","GAMMA_TOKEN"]}
JSON
cat > "$TMP/policy.fields" <<'FIELDS'
true
enforce
3
2
1
ALPHA_TOKEN
BETA_TOKEN
GAMMA_TOKEN
FIELDS

test_bash_older_than_four_refuses
test_parser_non_zero_refuses
test_short_parser_output_refuses
test_empty_parser_output_reports_zero_fields
test_well_formed_policy_prints_name_table
printf 'PASS: probe member credentials guards\n'