#!/usr/bin/env bash
# test_build_hub_push_once.sh — build-hub.sh refuses to push a version the registry already has (R-1098).
#
# Same shape as felhom-controller/controller/scripts/test_build_push_once.sh: a fake `docker` first on PATH answers
# `manifest inspect` as FAKE_MODE says and reports any build/push it is asked for, so nothing is ever built or pushed.
# The REAL build-hub.sh runs (a copy next to a scratch clean clone, so its workspace/ is scratch too) — the test cannot
# pass with the check deleted, which is the red-proof.
#   tag present            -> refused, "already exists", no build reached
#   tag absent             -> "is not present", proceeds
#   registry unreachable   -> refused, "Could not establish"
#   auth failure           -> refused, "Could not establish"
#   --multiarch, present   -> refused
#   local build, present   -> not refused (the check does not run)
# Run: bash scripts/test_build_hub_push_once.sh   (exit 0 all cases right · 1 a case wrong)
set -uo pipefail
HERE="$(cd "$(dirname "$0")" && pwd)"
WS="$(mktemp -d)"
trap 'rm -rf "${WS:?}"' EXIT
fails=0; ran=0

mkdir -p "$WS/bin" "$WS/build"
cat > "$WS/bin/docker" <<'FAKE'
#!/bin/bash
case "$1 $2" in
  "manifest inspect")
    case "${FAKE_MODE}" in
      present) echo '{"schemaVersion":2}'; exit 0 ;;
      absent)  echo "manifest unknown: manifest unknown" >&2; exit 1 ;;
      down)    echo "Get \"https://gitea.dooplex.hu/v2/\": dial tcp: connection refused" >&2; exit 1 ;;
      denied)  echo "unauthorized: authentication required" >&2; exit 1 ;;
    esac ;;
  "build "*|"buildx "*|"push "*) echo "FAKE-DOCKER-REACHED: $*"; exit 0 ;;
esac
exit 0
FAKE
chmod +x "$WS/bin/docker"
cp "$HERE/build-hub.sh" "$WS/build/build.sh"

git init -q --bare -b main "$WS/origin.git"
git clone -q "$WS/origin.git" "$WS/clone" 2>/dev/null
(cd "$WS/clone" && mkdir -p hub/cmd/hub hub/internal/api hub/internal/store hub/internal/web \
    && printf 'module x\n\ngo 1.22\n' > hub/go.mod && echo a > hub/cmd/hub/a.txt \
    && git add -A && git -c user.name=t -c user.email=t@t commit -q -m init && git push -q origin main)

run() {  # name, mode, expected rc ("any" = do not assert), required fragment, forbidden fragment, args...
    local name="$1" mode="$2" want="$3" need="$4" forbid="$5"; shift 5
    local out rc
    out=$(cd "$WS/build" && FAKE_MODE="$mode" PATH="$WS/bin:$PATH" FELHOM_HUB_REPO_DIR="$WS/clone" bash ./build.sh "$@" 2>&1); rc=$?
    ran=$((ran+1))
    if [[ "$want" != "any" && "$rc" != "$want" ]]; then
        fails=$((fails+1)); echo "  FAIL $name: exit $rc, want $want"; echo "$out" | tail -5 | sed 's/^/        /'; return
    fi
    if [[ -n "$need" ]] && ! grep -qi -- "$need" <<<"$out"; then
        fails=$((fails+1)); echo "  FAIL $name: no '$need'"; echo "$out" | tail -5 | sed 's/^/        /'; return
    fi
    if [[ -n "$forbid" ]] && grep -qi -- "$forbid" <<<"$out"; then
        fails=$((fails+1)); echo "  FAIL $name: contains '$forbid'"; echo "$out" | tail -5 | sed 's/^/        /'; return
    fi
    echo "  ok   $name"
}

echo "build-hub.sh — a version number is pushed once"
run "--push, tag present -> refuses"          present 1   "already exists in the registry" "FAKE-DOCKER-REACHED" 9.9.9 --push
run "--push, tag absent -> proceeds"          absent  any "is not present in the registry" "already exists"      9.9.9 --push
run "--multiarch, tag present -> refuses"     present 1   "already exists in the registry" "FAKE-DOCKER-REACHED" 9.9.9 --multiarch
run "--push, registry unreachable -> refuses" down    1   "Could not establish whether"    "FAKE-DOCKER-REACHED" 9.9.9 --push
run "--push, auth failure -> refuses"         denied  1   "Could not establish whether"    "FAKE-DOCKER-REACHED" 9.9.9 --push
run "local build, tag present -> not refused" present any ""                               "already exists in the registry" 9.9.9

echo
if [[ $fails -eq 0 ]]; then echo "all $ran cases behaved"; exit 0; fi
echo "$fails of $ran cases FAILED"; exit 1