#!/usr/bin/env bash
# Fresh Compose flow: mounted Pi policy/auth must produce a selectable, credential-ready provider.
set -euo pipefail

root="$(cd "$(dirname "$0")/.." && pwd -P)"
tmp="$(mktemp -d "${TMPDIR%/}/thoth-provider-readiness.XXXXXX")"
project="thothii-provider-readiness-$$"
compose=(
  docker compose --project-name "$project" --env-file "$tmp/local.env"
  -f "$root/compose.yaml" -f "$root/deploy/compose.local.yaml"
)
cleanup() {
  "${compose[@]}" down --volumes --remove-orphans >/dev/null 2>&1 || true
  rm -rf "$tmp"
}
trap cleanup EXIT HUP INT TERM

printf '%s\n' '{"zai":{"type":"api_key","key":"fixture-native-auth-key"}}' >"$tmp/pi-auth.json"
printf '%s\n' 'THT_MODEL_API_KEY=fixture-model-api-key' >"$tmp/thothii.secrets"
chmod 0600 "$tmp/pi-auth.json" "$tmp/thothii.secrets"
printf '%s\n' \
  'THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git' \
  "PI_AUTH_FILE=$tmp/pi-auth.json" \
  "THT_SECRETS_FILE=$tmp/thothii.secrets" \
  'THOTH_CORE_HTTP_PORT=0' \
  'THOTH_HTTP_PORT=0' \
  >"$tmp/local.env"

"${compose[@]}" up --detach --wait --wait-timeout 90 --build core
core_id="$("${compose[@]}" ps -q core)"
core_address="$("${compose[@]}" port core 8787 | head -n 1)"

"${compose[@]}" exec -T core sh -ceu '
  test -r /home/thoth/.pi/agent/auth.json
  test -r /home/thoth/.pi/agent/models.json
  test -r /home/thoth/.pi/agent/settings.json
  test -r /run/secrets/thothii.secrets
'

curl --fail --silent --show-error "http://$core_address/models" >"$tmp/models.json"
node - "$tmp/models.json" <<'NODE'
const fs = require("fs");
const body = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
if (!body.models?.some((model) => model.provider === "zai" && model.id === "glm-5.2")) {
  throw new Error("fresh Compose did not expose the mounted Pi-enabled model");
}
NODE

curl --fail --silent --show-error -X PUT \
  -H 'content-type: application/json' \
  --data '{"provider":"zai","model":"glm-5.2","reasoning":"low"}' \
  "http://$core_address/pi-management/config" >"$tmp/configured.json"
curl --fail --silent --show-error \
  "http://$core_address/pi-management/status" >"$tmp/status.json"
node - "$tmp/status.json" <<'NODE'
const fs = require("fs");
const body = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
if (!body.ready || body.credentials !== "present") {
  throw new Error("mounted Pi provider is not credential-ready");
}
if (body.config?.provider !== "zai" || body.config?.model !== "glm-5.2") {
  throw new Error("Pi provider configuration was not persisted");
}
NODE

inspect="$(docker inspect "$core_id")"
for secret in fixture-native-auth-key fixture-model-api-key; do
  if grep -Fq "$secret" <<<"$inspect"; then
    echo "container inspection leaked $secret" >&2
    exit 1
  fi
done

echo "Compose provider-readiness contract passed."