#!/bin/sh
set -eu

cd "$(dirname "$0")/.."

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
auth_file="$tmp/auth.json"
printf '%s\n' '{}' >"$auth_file"
chmod 0600 "$auth_file"
auth_config="$tmp/auth"
mkdir "$auth_config"
chmod 0700 "$auth_config"
printf '%s\n' 'mode: local' >"$auth_config/auth.yaml"
chmod 0600 "$auth_config/auth.yaml"
secrets_file="$tmp/thothii.secrets"
printf '%s\n' 'THT_MODEL_API_KEY=fixture-model-api-key' >"$secrets_file"
chmod 0600 "$secrets_file"
installation_file="$tmp/thothii-installation.yaml"
printf '%s\n' 'schemaVersion: 2' >"$installation_file"
chmod 0600 "$installation_file"

rendered=$(THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git \
  PI_AUTH_FILE="$auth_file" THT_SECRETS_FILE="$secrets_file" \
  THT_AUTH_CONFIG_ROOT="$auth_config" THT_INSTALLATION_CONFIG_SOURCE="$installation_file" \
  docker compose config)
printf '%s\n' "$rendered" | grep -q "source: $auth_file"
printf '%s\n' "$rendered" | grep -q 'target: /home/thoth/.pi/agent/auth.json'
printf '%s\n' "$rendered" | grep -A4 'target: /home/thoth/.pi/agent/auth.json' \
  | grep -q 'read_only: true'
if printf '%s\n' "$rendered" | grep -Eq '/home/thoth/\.pi/agent/(models|settings)\.json'; then
  echo "base Compose must not mount model projections without the generated override" >&2
  exit 1
fi
printf '%s\n' "$rendered" | grep -q "file: $secrets_file"
printf '%s\n' "$rendered" | grep -q 'target: thothii.secrets'
if grep -Fq 'fixture-model-api-key' <<<"$rendered"; then
  echo "rendered base Compose leaked the model key" >&2
  exit 1
fi

dev_rendered=$(THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git \
  PI_AUTH_FILE="$auth_file" THT_SECRETS_FILE="$secrets_file" \
  THT_AUTH_CONFIG_ROOT="$auth_config" THT_INSTALLATION_CONFIG_SOURCE="$installation_file" \
  docker compose --env-file deploy/env/local.env.example -f docker-compose.dev.yml config)
printf '%s\n' "$dev_rendered" | grep -q "source: $auth_file"
printf '%s\n' "$dev_rendered" | grep -q 'target: /home/thoth/.pi/agent/auth.json'
if printf '%s\n' "$dev_rendered" | grep -Eq '/home/thoth/\.pi/agent/(models|settings)\.json'; then
  echo "development Compose must not contain legacy model sources" >&2
  exit 1
fi
printf '%s\n' "$dev_rendered" | grep -q "file: $secrets_file"
printf '%s\n' "$dev_rendered" | grep -q 'target: thothii.secrets'
if grep -Fq 'fixture-model-api-key' <<<"$dev_rendered"; then
  echo "rendered development Compose leaked the model key" >&2
  exit 1
fi

if grep -R -n 'registerProvider' harness/.pi/extensions; then
  echo "Pi model providers must be declared in the Installation Model Catalog, not in code" >&2
  exit 1
fi

grep -q '^ARG PI_VERSION=0.80.3$' docker/core.Dockerfile
grep -q '^PI_AUTH_FILE=/absolute/path/to/pi-auth.json$' deploy/env/local.env.example
grep -q '^PI_AUTH_FILE=/absolute/path/to/pi-auth.json$' deploy/env/server.env.example
grep -q '^THT_SECRETS_FILE=/absolute/path/to/thothii.secrets$' deploy/env/local.env.example
grep -q '^THT_SECRETS_FILE=/absolute/path/to/thothii.secrets$' deploy/env/server.env.example

echo "Pi user-auth Compose contract passed."