#!/bin/sh
set -eu

cd "$(dirname "$0")/.."
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT HUP INT TERM

fake="$tmp/docker"
log="$tmp/docker.log"
cat >"$fake" <<'SH'
#!/bin/sh
set -eu
printf '%s:%s\n' "${THT_VECTOR_BOOTSTRAP_USER:-unset}" "$*" >>"$FAKE_DOCKER_LOG"
exit "${FAKE_DOCKER_EXIT:-0}"
SH
chmod 0755 "$fake"

printf '%s' old-password >"$tmp/old"
printf '%s' "new-'quoted-\$-password" >"$tmp/new"
cp "$tmp/old" "$tmp/original"

printf 'invalid password\n' >"$tmp/whitespace"
: >"$log"
if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
    ./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/whitespace" \
    >"$tmp/out" 2>"$tmp/err"; then
  echo "rotation accepted a whitespace-containing secret" >&2
  exit 1
fi
cmp "$tmp/old" "$tmp/original"
test ! -s "$log"
if find "$tmp" -name 'old.rotate.*' -print | grep -q .; then
  echo "rotation staged a deployment file before secret validation" >&2
  exit 1
fi

if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" FAKE_DOCKER_EXIT=1 \
    ./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
    >"$tmp/out" 2>"$tmp/err"; then
  echo "rotation unexpectedly succeeded when database verification failed" >&2
  exit 1
fi
cmp "$tmp/old" "$tmp/original"

: >"$log"
PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
  ./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
  >"$tmp/out" 2>"$tmp/err"
cmp "$tmp/old" "$tmp/new"
grep -q '/run/secrets/bootstrap-old:ro' "$log"
grep -q '/run/secrets/bootstrap-new:ro' "$log"
grep -q '^custom_admin:' "$log"
grep -q 'atomically replaced only after verified database login' "$tmp/out"

echo "bootstrap rotation ordering and no-config-change failure contracts passed."