#!/bin/sh
# ==============================================================================
# build-and-test.sh — captures evidence for every acceptance criterion (AC-1..AC-8)
# Run ON THE GUEST:  ssh root@192.168.178.57 'sh -s' < build-and-test.sh
# ==============================================================================
W=/var/www/atheos
B=$W/workspace/blog
pass=0; fail=0
ok()   { echo "  PASS  $1"; pass=$((pass+1)); }
bad()  { echo "  FAIL  $1"; fail=$((fail+1)); }
chk()  { if [ "$2" = "$3" ]; then ok "$1 ($2)"; else bad "$1 (got '$2', want '$3')"; fi; }
asuser() { su -s /bin/sh atheos -c "$1"; }

echo "=============================================================="
echo "AC-2  Atheos is served by nginx+PHP (not 502/404)"
echo "=============================================================="
CODE=$(wget -qO /tmp/idx.html --server-response http://127.0.0.1/ 2>&1 | sed -n 's/.*HTTP\/1\.[01] \([0-9]*\).*/\1/p' | head -1)
chk "HTTP status for /" "$CODE" "200"
if grep -qi '<title>Atheos IDE</title>' /tmp/idx.html 2>/dev/null; then ok "served page is the Atheos IDE"; else bad "served page is not Atheos"; fi
if grep -qiE 'install|setup' /tmp/idx.html 2>/dev/null; then ok "first-run installer/login markers present"; else bad "no installer markers"; fi
SOCK=$(sed -n 's/^listen = //p' /etc/php83/php-fpm.d/www.conf | head -1)
NGX=$(sed -n 's/.*fastcgi_pass unix:\([^;]*\);.*/\1/p' /etc/nginx/http.d/atheos.conf | head -1)
echo "  --- socket contract (I-1):"
echo "      php-fpm listen   : $SOCK"
echo "      nginx fastcgi    : $NGX"
chk "socket paths byte-match" "$NGX" "$SOCK"

echo
echo "=============================================================="
echo "AC-3  'blog' is present with files that can be opened"
echo "=============================================================="
chk "posts found" "$(ls $B/src/content/*.md 2>/dev/null | wc -l | tr -d ' ')" "20"
if [ -d "$W/workspace/blog/.git" ]; then ok "it is a git working copy"; else bad "not a git working copy"; fi
chk "theme present" "$(ls $B/src/themes 2>/dev/null | tr -d ' ')" "cleanblog"
chk "workspace owner" "$(stat -c '%U' $W/workspace/blog)" "atheos"

echo
echo "=============================================================="
echo "AC-4  An edit persists to disk (as the FPM user)"
echo "=============================================================="
asuser "printf 'x\n' > $B/.ac4-probe" >/dev/null 2>&1
if [ "$(asuser "cat $B/.ac4-probe" 2>/dev/null)" = "x" ]; then ok "write+read back as 'atheos'"; else bad "cannot write as atheos"; fi
asuser "rm -f $B/.ac4-probe" >/dev/null 2>&1
for p in config.php data workspace plugins themes; do
  if asuser "test -w $W/$p" 2>/dev/null; then ok "writable: $p"; else bad "NOT writable: $p"; fi
done

echo
echo "=============================================================="
echo "AC-5  Remote points at Gitea; the SSH switch is documented"
echo "=============================================================="
REMOTE=$(asuser "git -C $B remote get-url origin" 2>/dev/null)
echo "  remote now: $REMOTE"
case "$REMOTE" in
  *aridgwayweb.com*armistace/blog*) ok "remote targets armistace/blog on Gitea (HTTPS)" ;;
  gitea-blog:armistace/blog*)       ok "remote targets armistace/blog via the deploy-key alias" ;;
  *) bad "remote does not target the blog repo" ;;
esac
chk "branch" "$(asuser "git -C $B rev-parse --abbrev-ref HEAD" 2>/dev/null)" "master"

# Phase 2: once the SSH alias is in use, prove the transport actually authenticates
case "$REMOTE" in
  gitea-blog:*)
    AUTH=$(asuser 'ssh -o BatchMode=yes -o ConnectTimeout=8 -T gitea-blog 2>&1' | head -1)
    case "$AUTH" in
      *successfully\ authenticated*) ok "deploy key authenticates over SSH" ;;
      *) bad "deploy key does NOT authenticate: $AUTH" ;;
    esac
    ;;
esac

echo
echo "=============================================================="
echo "AC-6  Survives reboot (services enabled, data intact)"
echo "=============================================================="
echo "  container uptime: $(cut -d. -f1 /proc/uptime)s  (reboot was issued during the test)"
for s in nginx php-fpm83 sshd; do
  if rc-update show 2>/dev/null | grep -qE "^\s+$s\s+\|\s+default"; then ok "$s enabled at boot"; else bad "$s NOT enabled at boot"; fi
  if rc-service "$s" status >/dev/null 2>&1; then ok "$s running"; else bad "$s not running"; fi
done
if [ -S "$SOCK" ]; then ok "fpm socket exists after reboot"; else bad "fpm socket missing"; fi

echo
echo "=============================================================="
echo "AC-8  SCOPE GUARD: no build toolchain present (must be ABSENT)"
echo "=============================================================="
for t in python python3 pelican pip pip3 make; do
  if command -v "$t" >/dev/null 2>&1; then bad "$t IS present - scope violated!"; else ok "$t absent (correct)"; fi
done
echo "  --- also check no database engine was installed (Atheos needs none):"
for d in mysqld mariadbd postgres redis-server; do
  if command -v "$d" >/dev/null 2>&1; then bad "$d present - unexpected"; else ok "$d absent (correct)"; fi
done

echo
echo "=============================================================="
echo "FR-11 GUARD: agent created NO identity or armistace credential"
echo "=============================================================="
chk "git user.name empty"  "$(asuser 'git config --get user.name'  2>/dev/null)" ""
chk "git user.email empty" "$(asuser 'git config --get user.email' 2>/dev/null)" ""
if [ -f /home/atheos/.ssh/id_ed25519_blog ]; then ok "deploy key present"; else bad "deploy key missing"; fi
chk "deploy key mode" "$(stat -c '%a' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "600"
chk "deploy key owner" "$(stat -c '%U' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "atheos"
chk "ssh config mode" "$(stat -c '%a' /home/atheos/.ssh/config 2>/dev/null)" "600"

echo
echo "=============================================================="
echo "RESOURCES"
echo "=============================================================="
echo "  rootfs: $(df -hP / | tail -1 | awk '{print $2" total, "$3" used, "$4" avail ("$5")"}')"
echo "  NOTE: \`free\` and \`uptime\` report the HOST, not this container - lxcfs is not"
echo "        installed. The enforced limit is memory=1024MB/swap=256MB from PVE."
echo "        Check real usage host-side: cat /sys/fs/cgroup/lxc/136/memory.current"
echo "  listening ports: $(netstat -tln 2>/dev/null | awk '/LISTEN/{split($4,a,":"); print a[length(a)]}' | sort -u | tr '\n' ' ')"

echo
echo "=============================================================="
printf 'RESULT: %d passed, %d failed\n' "$pass" "$fail"
echo "=============================================================="
[ "$fail" -eq 0 ] || exit 1