#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
TEST_DIR="$(mktemp -d)"
PASS_COUNT=0

cleanup() {
  if [[ -n "${TEST_DIR:-}" && -d "$TEST_DIR" && "$TEST_DIR" == /tmp/* ]]; then
    rm -rf -- "$TEST_DIR"
  fi
}
trap cleanup EXIT

pass() {
  PASS_COUNT=$((PASS_COUNT + 1))
  printf '[PASS] %s\n' "$1"
}

expect_failure() {
  local label="$1"
  shift
  if "$@" >"$TEST_DIR/last-command.out" 2>&1; then
    printf '[FAIL] expected rejection: %s\n' "$label" >&2
    exit 1
  fi
  pass "$label"
}

make_layout() {
  local root="$1"
  mkdir -p "$root/inbox" "$root/archive" "$root/weekly"
}

make_batch() {
  local target="$1"
  local run_id="$2"
  mkdir -p "$target"
  printf 'synthetic database payload\n' >"$target/database.dump"
  printf 'synthetic storage payload\n' >"$target/storage.tar.gz"
  python3 - "$target" "$run_id" <<'PYTHON'
import hashlib
import json
import os
import sys

target, run_id = sys.argv[1:]
def artifact(file_name):
    file_path = os.path.join(target, file_name)
    with open(file_path, "rb") as handle:
        content = handle.read()
    return {"file": file_name, "bytes": len(content), "sha256": hashlib.sha256(content).hexdigest()}

manifest = {
    "schemaVersion": 1,
    "runId": run_id,
    "createdAt": "2026-01-01T00:00:00Z",
    "buildSha": "a" * 40,
    "sourceImageDigest": None,
    "status": "complete",
    "artifacts": {
        "database": artifact("database.dump"),
        "storage": artifact("storage.tar.gz"),
    },
}
with open(os.path.join(target, "manifest.json"), "x", encoding="utf-8") as handle:
    json.dump(manifest, handle, indent=2)
    handle.write("\n")
PYTHON
}

receiver() {
  local layout="$1"
  shift
  env RECEIVER_TEST_MODE=1 RECEIVER_CONFIG_FILE="$TEST_DIR/no-receiver-config" \
    BACKUP_INBOX_DIR="$layout/inbox" BACKUP_ARCHIVE_DIR="$layout/archive" \
    BACKUP_WEEKLY_DIR="$layout/weekly" DAILY_KEEP=7 WEEKLY_KEEP=4 \
    "$ROOT_DIR/scripts/receive-offhost-backup.sh" "$@"
}

CURRENT_RUN_ID="auto-$(date -u +%Y%m%dT%H%M%SZ)"
CURRENT_BATCH="hyb-oa-backup-$CURRENT_RUN_ID"

VALID_LAYOUT="$TEST_DIR/receiver-valid"
make_layout "$VALID_LAYOUT"
make_batch "$VALID_LAYOUT/inbox/${CURRENT_BATCH}.partial" "$CURRENT_RUN_ID"
VALID_MANIFEST_SHA="$(sha256sum "$VALID_LAYOUT/inbox/${CURRENT_BATCH}.partial/manifest.json" | awk '{print $1}')"
receiver "$VALID_LAYOUT" finalize-test "$CURRENT_RUN_ID" "$VALID_MANIFEST_SHA" >/dev/null
[[ -d "$VALID_LAYOUT/archive/$CURRENT_BATCH" && ! -e "$VALID_LAYOUT/inbox/${CURRENT_BATCH}.partial" ]]
pass "receiver finalizes one complete synthetic batch"

receiver "$VALID_LAYOUT" finalize-test "$CURRENT_RUN_ID" "$VALID_MANIFEST_SHA" >/dev/null
pass "receiver treats an identical repeated finalize as idempotent"

SECOND_RUN_ID="auto-$(date -u +%Y%m%d)T000000Z"
if [[ "$SECOND_RUN_ID" == "$CURRENT_RUN_ID" ]]; then
  SECOND_RUN_ID="auto-$(date -u +%Y%m%d)T000001Z"
fi
SECOND_BATCH="hyb-oa-backup-$SECOND_RUN_ID"
make_batch "$VALID_LAYOUT/inbox/${SECOND_BATCH}.partial" "$SECOND_RUN_ID"
SECOND_MANIFEST_SHA="$(sha256sum "$VALID_LAYOUT/inbox/${SECOND_BATCH}.partial/manifest.json" | awk '{print $1}')"
expect_failure "receiver rejects a different automatic batch for the same UTC day" \
  receiver "$VALID_LAYOUT" finalize-test "$SECOND_RUN_ID" "$SECOND_MANIFEST_SHA"

negative_receiver_case() {
  local label="$1"
  local mutation="$2"
  local layout="$TEST_DIR/receiver-negative-${PASS_COUNT}"
  make_layout "$layout"
  make_batch "$layout/inbox/${CURRENT_BATCH}.partial" "$CURRENT_RUN_ID"
  case "$mutation" in
    corrupt-artifact) printf 'changed\n' >>"$layout/inbox/${CURRENT_BATCH}.partial/database.dump" ;;
    corrupt-manifest) printf ' ' >>"$layout/inbox/${CURRENT_BATCH}.partial/manifest.json" ;;
    extra-file) printf 'extra\n' >"$layout/inbox/${CURRENT_BATCH}.partial/extra.txt" ;;
    symlink) rm "$layout/inbox/${CURRENT_BATCH}.partial/storage.tar.gz"; ln -s database.dump "$layout/inbox/${CURRENT_BATCH}.partial/storage.tar.gz" ;;
  esac
  local sha
  sha="$(sha256sum "$layout/inbox/${CURRENT_BATCH}.partial/manifest.json" | awk '{print $1}')"
  if [[ "$mutation" == "corrupt-manifest" ]]; then
    sha="$VALID_MANIFEST_SHA"
  fi
  expect_failure "$label" receiver "$layout" finalize-test "$CURRENT_RUN_ID" "$sha"
  [[ ! -e "$layout/archive/$CURRENT_BATCH" ]]
}

negative_receiver_case "receiver rejects an artifact checksum mismatch" corrupt-artifact
negative_receiver_case "receiver rejects a manifest checksum mismatch" corrupt-manifest
negative_receiver_case "receiver rejects an extra file" extra-file
negative_receiver_case "receiver rejects links in a batch" symlink

RESUME_LAYOUT="$TEST_DIR/receiver-resume"
make_layout "$RESUME_LAYOUT"
make_batch "$RESUME_LAYOUT/inbox/${CURRENT_BATCH}.partial" "$CURRENT_RUN_ID"
RESUME_MANIFEST_SHA="$(sha256sum "$RESUME_LAYOUT/inbox/${CURRENT_BATCH}.partial/manifest.json" | awk '{print $1}')"
mv "$RESUME_LAYOUT/inbox/${CURRENT_BATCH}.partial/storage.tar.gz" "$TEST_DIR/resume-storage.tar.gz"
expect_failure "receiver keeps an incomplete partial batch out of archive" \
  receiver "$RESUME_LAYOUT" finalize-test "$CURRENT_RUN_ID" "$RESUME_MANIFEST_SHA"
mv "$TEST_DIR/resume-storage.tar.gz" "$RESUME_LAYOUT/inbox/${CURRENT_BATCH}.partial/storage.tar.gz"
receiver "$RESUME_LAYOUT" finalize-test "$CURRENT_RUN_ID" "$RESUME_MANIFEST_SHA" >/dev/null
[[ -d "$RESUME_LAYOUT/archive/$CURRENT_BATCH" ]]
pass "receiver finalizes the same partial directory after transfer resumes"

FORCED_LAYOUT="$TEST_DIR/receiver-forced"
make_layout "$FORCED_LAYOUT"
expect_failure "receiver rejects rsync sender/read mode" env \
  RECEIVER_CONFIG_FILE="$TEST_DIR/no-receiver-config" \
  BACKUP_INBOX_DIR="$FORCED_LAYOUT/inbox" BACKUP_ARCHIVE_DIR="$FORCED_LAYOUT/archive" \
  BACKUP_WEEKLY_DIR="$FORCED_LAYOUT/weekly" \
  SSH_ORIGINAL_COMMAND="rsync --server --sender -logDtpre.iLsfxCIvu . ." \
  "$ROOT_DIR/scripts/receive-offhost-backup.sh" forced
expect_failure "receiver rejects a sender flag in a later rsync position" env \
  RECEIVER_CONFIG_FILE="$TEST_DIR/no-receiver-config" \
  BACKUP_INBOX_DIR="$FORCED_LAYOUT/inbox" BACKUP_ARCHIVE_DIR="$FORCED_LAYOUT/archive" \
  BACKUP_WEEKLY_DIR="$FORCED_LAYOUT/weekly" \
  SSH_ORIGINAL_COMMAND="rsync --server -logDtpre.iLsfxCIvu --sender . ." \
  "$ROOT_DIR/scripts/receive-offhost-backup.sh" forced
expect_failure "receiver rejects destructive rsync flags" env \
  RECEIVER_CONFIG_FILE="$TEST_DIR/no-receiver-config" \
  BACKUP_INBOX_DIR="$FORCED_LAYOUT/inbox" BACKUP_ARCHIVE_DIR="$FORCED_LAYOUT/archive" \
  BACKUP_WEEKLY_DIR="$FORCED_LAYOUT/weekly" \
  SSH_ORIGINAL_COMMAND="rsync --server --delete -logDtpre.iLsfxCIvu . ." \
  "$ROOT_DIR/scripts/receive-offhost-backup.sh" forced
expect_failure "receiver rejects an ordinary shell command" env \
  RECEIVER_CONFIG_FILE="$TEST_DIR/no-receiver-config" \
  BACKUP_INBOX_DIR="$FORCED_LAYOUT/inbox" BACKUP_ARCHIVE_DIR="$FORCED_LAYOUT/archive" \
  BACKUP_WEEKLY_DIR="$FORCED_LAYOUT/weekly" SSH_ORIGINAL_COMMAND="sh -c id" \
  "$ROOT_DIR/scripts/receive-offhost-backup.sh" forced

NESTED_LAYOUT="$TEST_DIR/receiver-nested"
mkdir -p "$NESTED_LAYOUT/inbox/archive" "$NESTED_LAYOUT/weekly"
expect_failure "receiver rejects archive nested inside the rsync inbox" env \
  RECEIVER_CONFIG_FILE="$TEST_DIR/no-receiver-config" \
  BACKUP_INBOX_DIR="$NESTED_LAYOUT/inbox" BACKUP_ARCHIVE_DIR="$NESTED_LAYOUT/inbox/archive" \
  BACKUP_WEEKLY_DIR="$NESTED_LAYOUT/weekly" \
  "$ROOT_DIR/scripts/receive-offhost-backup.sh" validate-config

RETENTION_LAYOUT="$TEST_DIR/receiver-retention"
make_layout "$RETENTION_LAYOUT"
for day in 01 02 03 04 05 06 07; do
  mkdir "$RETENTION_LAYOUT/archive/hyb-oa-backup-auto-202601${day}T023000Z"
done
for week in 01 02 03 04; do
  mkdir "$RETENTION_LAYOUT/weekly/week-2026-W${week}"
done
make_batch "$RETENTION_LAYOUT/inbox/${CURRENT_BATCH}.partial" "$CURRENT_RUN_ID"
RETENTION_SHA="$(sha256sum "$RETENTION_LAYOUT/inbox/${CURRENT_BATCH}.partial/manifest.json" | awk '{print $1}')"
receiver "$RETENTION_LAYOUT" finalize-test "$CURRENT_RUN_ID" "$RETENTION_SHA" >/dev/null
[[ "$(find "$RETENTION_LAYOUT/archive" -mindepth 1 -maxdepth 1 -type d | wc -l)" == "7" ]]
[[ "$(find "$RETENTION_LAYOUT/weekly" -mindepth 1 -maxdepth 1 -type d | wc -l)" == "4" ]]
[[ -d "$RETENTION_LAYOUT/archive/$CURRENT_BATCH" ]]
pass "receiver retains seven daily and four weekly recovery points while protecting current success"

EMPTY_SOURCE="$TEST_DIR/empty-rsync-source"
EMPTY_TARGET="$TEST_DIR/empty-rsync-target"
mkdir "$EMPTY_SOURCE" "$EMPTY_TARGET"
rsync -a --dry-run --chmod=Du=rwx,Dgo=,Fu=rw,Fgo= "$EMPTY_SOURCE/" "$EMPTY_TARGET/"
pass "installed rsync accepts the production chmod contract"

WRAPPER_ROOT="$TEST_DIR/wrapper-root"
WRAPPER_PG="$TEST_DIR/wrapper-pg"
WRAPPER_STORAGE="$TEST_DIR/wrapper-storage"
WRAPPER_BACKUPS="$TEST_DIR/wrapper-backups"
WRAPPER_STATE="$TEST_DIR/wrapper-state"
MOCK_BIN="$TEST_DIR/mock-bin"
mkdir -p "$WRAPPER_ROOT/deploy/trialrun" "$WRAPPER_PG" "$WRAPPER_STORAGE" \
  "$WRAPPER_BACKUPS" "$WRAPPER_STATE" "$MOCK_BIN"
printf '16\n' >"$WRAPPER_PG/PG_VERSION"
printf 'synthetic attachment\n' >"$WRAPPER_STORAGE/marker.txt"
printf 'synthetic env\n' >"$WRAPPER_ROOT/deploy/trialrun/.env"
ln -s "$ROOT_DIR/scripts" "$WRAPPER_ROOT/scripts"
printf 'private-key-fixture\n' >"$TEST_DIR/offhost-key"
chmod 0600 "$TEST_DIR/offhost-key"
printf 'backup-alias ssh-ed25519 fixture\n' >"$TEST_DIR/known-hosts"

BUILD_SHA="abcdef1234567890abcdef1234567890abcdef12"
VITE_BUILD_SHA="${BUILD_SHA:0:12}"
MOCK_ALERT_LOG="$TEST_DIR/mock-alert.log"
export MOCK_PG="$WRAPPER_PG" MOCK_STORAGE="$WRAPPER_STORAGE" MOCK_BUILD_SHA="$BUILD_SHA" MOCK_ALERT_LOG

cat >"$MOCK_BIN/docker" <<'MOCK'
#!/usr/bin/env bash
set -euo pipefail
if [[ "${1:-}" == "compose" && "${2:-}" == "version" ]]; then exit 0; fi
if [[ "${1:-}" == "compose" ]]; then
  args=" $* "
  if [[ "$args" == *" ps -q server "* ]]; then echo server-id; exit 0; fi
  if [[ "$args" == *" ps -q db "* ]]; then echo db-id; exit 0; fi
  if [[ "$args" == *" exec -T server "* ]]; then cat >>"$MOCK_ALERT_LOG"; exit 0; fi
fi
if [[ "${1:-}" == "inspect" ]]; then
  template="${3:-}"
  container="${4:-}"
  case "$template" in
    *State.Status*) echo running ;;
    *Config.Env*)
      if [[ "$container" == "server-id" ]]; then
        printf 'BUILD_SHA=%s\nSTORAGE_DIR=/app/storage\nDATABASE_URL=postgresql://backup_user:fixture@db:5432/hyb_oa\n' "$MOCK_BUILD_SHA"
      else
        printf 'POSTGRES_DB=hyb_oa\nPOSTGRES_USER=backup_user\nPOSTGRES_PASSWORD=fixture\n'
      fi
      ;;
    *Mounts*)
      if [[ "$container" == "server-id" ]]; then
        printf '/app/storage\t%s\n' "$MOCK_STORAGE"
      else
        printf '/var/lib/postgresql/data\t%s\n' "$MOCK_PG"
      fi
      ;;
    *Image*) printf 'sha256:%064d\n' 0 ;;
    *) exit 1 ;;
  esac
  exit 0
fi
if [[ "${1:-}" == "exec" ]]; then
  if [[ " $* " == *" pg_dump "* ]]; then printf 'synthetic-dump\n'; exit 0; fi
  if [[ " $* " == *" pg_restore --list "* ]]; then cat >/dev/null; exit 0; fi
fi
exit 1
MOCK

cat >"$MOCK_BIN/rsync" <<'MOCK'
#!/usr/bin/env bash
exit "${MOCK_RSYNC_EXIT:-1}"
MOCK
cat >"$MOCK_BIN/ssh" <<'MOCK'
#!/usr/bin/env bash
exit "${MOCK_SSH_EXIT:-0}"
MOCK
chmod +x "$MOCK_BIN/docker" "$MOCK_BIN/rsync" "$MOCK_BIN/ssh"

wrapper_env=(
  env PATH="$MOCK_BIN:$PATH" REMOTE_DIR="$WRAPPER_ROOT"
  REMOTE_ENV_FILE="$WRAPPER_ROOT/deploy/trialrun/.env"
  COMPOSE_PROJECT_NAME="hyb-oa-current" POSTGRES_DATA_DIR="$WRAPPER_PG"
  STORAGE_HOST_DIR="$WRAPPER_STORAGE" BUILD_SHA="$BUILD_SHA" VITE_BUILD_SHA="$VITE_BUILD_SHA"
  AUTOMATIC_BACKUP_DIR="$WRAPPER_BACKUPS" AUTOMATIC_BACKUP_STATE_DIR="$WRAPPER_STATE"
  OFFHOST_TARGET="hybbackup@backup-alias" OFFHOST_SSH_KEY="$TEST_DIR/offhost-key"
  OFFHOST_KNOWN_HOSTS="$TEST_DIR/known-hosts" ALERT_RECIPIENT_EMPLOYEE_NO="OPS001"
)

exec 8>"$WRAPPER_STATE/automatic-backup.lock"
flock -n 8
expect_failure "wrapper rejects a concurrent automatic-backup run" \
  "${wrapper_env[@]}" "$ROOT_DIR/scripts/run-automatic-backup.sh" run
flock -u 8

rm -f "$WRAPPER_STATE/last-success.json"
for day in 01 02 03 04 05 06 07; do
  mkdir "$WRAPPER_BACKUPS/hyb-oa-backup-auto-202601${day}T023000Z"
done
expect_failure "unreachable rsync fails without writing off-host success" \
  "${wrapper_env[@]}" MOCK_RSYNC_EXIT=1 "$ROOT_DIR/scripts/run-automatic-backup.sh" run
[[ ! -e "$WRAPPER_STATE/last-success.json" ]]
[[ "$(find "$WRAPPER_BACKUPS" -mindepth 1 -maxdepth 1 -type d -name 'hyb-oa-backup-auto-*' | wc -l)" == "8" ]]
pass "source retention does not run before off-host finalize succeeds"
python3 - "$WRAPPER_STATE/last-run.json" <<'PYTHON'
import json
import os
import sys
with open(sys.argv[1], encoding="utf-8") as handle:
    payload = json.load(handle)
serialized = json.dumps(payload)
assert payload["issueId"] == "AUTO_BACKUP"
assert payload["status"] == "FAIL_AUTOMATIC_BACKUP"
assert not any(value in serialized for value in ("/tmp/", "postgresql://", "backup-alias", "fixture"))
PYTHON
pass "wrapper failure summary is category-only and redacted"

find "$WRAPPER_BACKUPS" -mindepth 1 -maxdepth 1 -type d -name 'hyb-oa-backup-auto-*' -exec rm -rf -- {} +
for day in 01 02 03 04 05 06 07; do
  mkdir "$WRAPPER_BACKUPS/hyb-oa-backup-auto-202601${day}T023000Z"
done
"${wrapper_env[@]}" MOCK_RSYNC_EXIT=0 MOCK_SSH_EXIT=0 \
  "$ROOT_DIR/scripts/run-automatic-backup.sh" run >/dev/null
[[ -f "$WRAPPER_STATE/last-success.json" ]]
[[ "$(find "$WRAPPER_BACKUPS" -mindepth 1 -maxdepth 1 -type d -name 'hyb-oa-backup-auto-*' | wc -l)" == "7" ]]
pass "off-host finalize success writes state and then prunes source retention to seven"

rm -f "$WRAPPER_STATE/last-success.json"
expect_failure "stale watchdog rejects a missing success record" \
  "${wrapper_env[@]}" "$ROOT_DIR/scripts/run-automatic-backup.sh" check-stale

python3 - "$WRAPPER_STATE/last-success.json" "$BUILD_SHA" <<'PYTHON'
import json
import sys
from datetime import datetime, timezone
with open(sys.argv[1], "w", encoding="utf-8") as handle:
    json.dump({
        "schemaVersion": 1,
        "status": "complete",
        "completedAt": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
        "runId": "auto-synthetic",
        "manifestSha256": "0" * 64,
        "composeProject": "hyb-oa-current",
        "buildSha": sys.argv[2],
    }, handle)
PYTHON
cp "$WRAPPER_STATE/last-success.json" "$WRAPPER_STATE/last-success.valid.json"
python3 - "$WRAPPER_STATE/last-success.json" <<'PYTHON'
import json
import sys
with open(sys.argv[1], encoding="utf-8") as handle:
    payload = json.load(handle)
payload["buildSha"] = "0" * 40
with open(sys.argv[1], "w", encoding="utf-8") as handle:
    json.dump(payload, handle)
PYTHON
expect_failure "stale watchdog rejects a success record from another build" \
  "${wrapper_env[@]}" "$ROOT_DIR/scripts/run-automatic-backup.sh" check-stale
mv "$WRAPPER_STATE/last-success.valid.json" "$WRAPPER_STATE/last-success.json"
"${wrapper_env[@]}" "$ROOT_DIR/scripts/run-automatic-backup.sh" check-stale >/dev/null
pass "stale watchdog accepts a fresh project/build-bound success record"

DRIFT_BUILD_SHA="0123456789abcdef0123456789abcdef01234567"
expect_failure "wrapper rejects an active runtime build that drifted from its installed contract" \
  "${wrapper_env[@]}" BUILD_SHA="$DRIFT_BUILD_SHA" VITE_BUILD_SHA="${DRIFT_BUILD_SHA:0:12}" \
  "$ROOT_DIR/scripts/run-automatic-backup.sh" check-stale

"${wrapper_env[@]}" "$ROOT_DIR/scripts/run-automatic-backup.sh" remind-drill >/dev/null
FIRST_REMINDER="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["findings"][0]["detail"])' "$WRAPPER_STATE/last-run.json")"
"${wrapper_env[@]}" "$ROOT_DIR/scripts/run-automatic-backup.sh" remind-drill >/dev/null
SECOND_REMINDER="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["findings"][0]["detail"])' "$WRAPPER_STATE/last-run.json")"
[[ "$FIRST_REMINDER" == "$SECOND_REMINDER" && "$FIRST_REMINDER" == quarterly_shadow_restore_due_* ]]
pass "quarterly reminder finding key is stable within the same quarter"

expect_failure "receiver installer uninstall rejects an unsafe target path" env \
  BACKUP_USER=hybbackup RECEIVER_TARGET=/ CONFIG_FILE=/etc/hyb-oa-test.conf \
  "$ROOT_DIR/deploy/trialrun/install-offhost-backup-receiver.sh" uninstall

expect_failure "receiver installer rejects a system-managed backup root before mutation" env \
  BACKUP_ROOT=/etc/hyb-oa-backups PUBLIC_KEY_FILE="$TEST_DIR/known-hosts" \
  RECEIVER_SOURCE="$ROOT_DIR/scripts/receive-offhost-backup.sh" \
  "$ROOT_DIR/deploy/trialrun/install-offhost-backup-receiver.sh" install

printf '[PASS] automatic off-host backup contract completed (%d checks)\n' "$PASS_COUNT"