#!/bin/sh
set -eu

cd "$(dirname "$0")/.."
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT HUP INT TERM

. ./deploy/vector/secret-policy.sh

: >"$tmp/empty"
printf 'has newline\n' >"$tmp/newline"
printf 'has space' >"$tmp/space"
printf 'safe-quoted-\047-dollar-$' >"$tmp/valid"
printf 'docker-secret' >"$tmp/docker"
printf 'owner-readonly' >"$tmp/readonly"
printf 'too-open' >"$tmp/open"
chmod 0600 "$tmp/valid"
chmod 0444 "$tmp/docker"
chmod 0400 "$tmp/readonly"
chmod 0640 "$tmp/open"

for invalid in empty newline space; do
  if validate_secret_file "$tmp/$invalid" "$invalid" >/dev/null 2>&1; then
    echo "secret policy accepted $invalid" >&2
    exit 1
  fi
done
validate_secret_file "$tmp/valid" valid
validate_secret_file "$tmp/readonly" readonly
if validate_secret_file "$tmp/docker" docker >/dev/null 2>&1; then
  echo "secret policy accepted world-readable host secret" >&2
  exit 1
fi
if validate_secret_file "$tmp/open" open >/dev/null 2>&1; then
  echo "secret policy accepted group-readable host secret" >&2
  exit 1
fi
test "$(read_secret_file "$tmp/valid" valid)" = "safe-quoted-'-dollar-$"

echo "shared vector secret policy contracts passed."