#!/bin/sh
set -eu

cd "$(dirname "$0")/.."

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
auth_file="$tmp/auth.json"
printf '%s\n' '{}' >"$auth_file"
chmod 0600 "$auth_file"

rendered=$(PI_AUTH_FILE="$auth_file" docker compose config)
printf '%s\n' "$rendered" | grep -q "source: $auth_file"
printf '%s\n' "$rendered" | grep -q 'target: /home/thoth/.pi/agent/auth.json'
printf '%s\n' "$rendered" | grep -A4 'target: /home/thoth/.pi/agent/auth.json' \
  | grep -q 'read_only: true'

python3 - <<'PY'
import json
from pathlib import Path

settings = json.loads(Path("deploy/pi/settings.json").read_text())
assert settings["enabledModels"] == [
    "zai/glm-5.2",
    "deepseek/deepseek-v4-flash",
    "deepseek/deepseek-v4-pro",
    "aritmolab/qwen3.6-35b-a3b",
]
PY

grep -q '^ARG PI_VERSION=0.80.3$' docker/core.Dockerfile
grep -q '^PI_AUTH_FILE=$auth_file$' scripts/bootstrap-local-psd-docker-config.sh

echo "Pi user-auth Compose contract passed."