#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT_DIR"

SANDBOX="$ROOT_DIR/sandbox/rho-run-approve-request"
REPO="$SANDBOX/repo"
OWNER_HOME="$SANDBOX/owner-rho-home"
COLLAB_HOME="$SANDBOX/collab-rho-home"
PRIVATE_ROOT="$SANDBOX/private"
OWNER_ID="rho://id/github/rho-owner"
COLLAB_ID="rho://id/github/rho-collab"
REQUEST_ID="req-approve"
DATASET_UUID="dataset-approve"
REQUEST_DIR="rho/messages/inbox/id/github/rho-owner/$REQUEST_ID"
RUN_ID="run-run-real-approve"
ACTION_ID="act-run-real-approve"
RECEIPT_DIR="rho/run-receipts/$REQUEST_ID"

rm -rf "$SANDBOX"
mkdir -p "$REPO"

git -C "$REPO" init >/dev/null
git -C "$REPO" config user.name "Rho Run Approve Test"
git -C "$REPO" config user.email "run-approve@example.test"
git -C "$REPO" config commit.gpgsign false

RHO_HOME="$OWNER_HOME" ./rho id init \
  --github rho-owner \
  --display-name "Rho Owner" \
  --generate-ssh-key >/dev/null
RHO_HOME="$COLLAB_HOME" ./rho id init \
  --github rho-collab \
  --display-name "Rho Collaborator" \
  --generate-ssh-key >/dev/null
RHO_HOME="$COLLAB_HOME" ./rho id export \
  --identity "$COLLAB_ID" \
  --out "$SANDBOX/rho-collab-public.yaml" >/dev/null
RHO_HOME="$OWNER_HOME" ./rho id import "$SANDBOX/rho-collab-public.yaml" >/dev/null

./rho repo init \
  --root "$REPO" \
  --repo-id rho://repo/local/run-approve \
  --owner "$OWNER_ID" >/dev/null

mkdir -p "$REPO/workspace" "$REPO/$REQUEST_DIR" "$PRIVATE_ROOT/$DATASET_UUID/real"
cat > "$REPO/workspace/sum_prices.awk" <<'AWK'
NR > 1 { total += $3 }
END { printf "%.2f\n", total }
AWK
cat > "$REPO/rho/tools/run_real.yaml" <<EOF
version: 1
tool:
  id: run_real
  action_type: run_real_data
  owner: $OWNER_ID
  approval_required: true
  command_template:
    - awk
    - -F,
    - -f
    - CODE_PATH
    - DATASET_CSV
EOF
cat > "$PRIVATE_ROOT/$DATASET_UUID/real/prices-real.csv" <<'CSV'
date,symbol,price
2026-01-01,A,100.01
2026-01-02,B,200.02
2026-01-03,C,300.03
2026-01-04,D,512.97
CSV
CODE_DIGEST="$(shasum -a 256 "$REPO/workspace/sum_prices.awk" | awk '{print $1}')"
INPUT_DIGEST="$(shasum -a 256 "$PRIVATE_ROOT/$DATASET_UUID/real/prices-real.csv" | awk '{print $1}')"

cat > "$REPO/$REQUEST_DIR/request.yaml" <<EOF
version: 1
request:
  id: $REQUEST_ID
  from: $COLLAB_ID
  to: $OWNER_ID
  type: private-analysis
  dataset_uuid: $DATASET_UUID
  code_path: rho://repo/workspace/sum_prices.awk
  code_sha256: $CODE_DIGEST
  requested_tier: real
EOF
RHO_HOME="$COLLAB_HOME" ./rho crypto sign \
  "$REPO/$REQUEST_DIR/request.yaml" \
  --identity "$COLLAB_ID" \
  --out "$REPO/$REQUEST_DIR/request.rhosig.yaml" \
  --repo-id rho://repo/local/run-approve \
  --request-id "$REQUEST_ID" \
  --recipient "$OWNER_ID" \
  --purpose rho.request >/dev/null
grep -q "purpose: rho.request" "$REPO/$REQUEST_DIR/request.rhosig.yaml"

RHO_HOME="$OWNER_HOME" ./rho run approve-request "$REQUEST_ID" \
  --root "$REPO" \
  --private-root "$PRIVATE_ROOT" \
  --runner local \
  > "$SANDBOX/approve-output.txt"

grep -q "request: $REQUEST_ID" "$SANDBOX/approve-output.txt"
grep -q "action: $ACTION_ID" "$SANDBOX/approve-output.txt"
grep -q "run: $RUN_ID" "$SANDBOX/approve-output.txt"
grep -q "runner: local" "$SANDBOX/approve-output.txt"
grep -q "receipt: $REPO/$RECEIPT_DIR/$RUN_ID.yaml" "$SANDBOX/approve-output.txt"
grep -q "next: rho result release $REQUEST_ID --run-id $RUN_ID --to $COLLAB_ID" "$SANDBOX/approve-output.txt"
grep -q "1113.03" "$REPO/.rho/runs/$RUN_ID/stdout.txt"
grep -q "status: completed" "$REPO/.rho/runs/$RUN_ID.yaml"
grep -q "runner: local" "$REPO/.rho/runs/$RUN_ID.yaml"
grep -q "awk" "$REPO/.rho/runs/$RUN_ID.yaml"
grep -q "sum_prices.awk" "$REPO/.rho/runs/$RUN_ID.yaml"
grep -q "$CODE_DIGEST" "$REPO/.rho/runs/$RUN_ID.yaml"
grep -q "$INPUT_DIGEST" "$REPO/.rho/action-grants/$ACTION_ID.yaml"
test -f "$REPO/.rho/action-grants/$ACTION_ID.rhosig.yaml"
test -f "$REPO/rho/approval-grants/$REQUEST_ID/$ACTION_ID.yaml"
test -f "$REPO/rho/approval-grants/$REQUEST_ID/$ACTION_ID.rhosig.yaml"
test -f "$REPO/$RECEIPT_DIR/$RUN_ID.yaml"
test -f "$REPO/$RECEIPT_DIR/$RUN_ID.rhosig.yaml"
grep -q "$INPUT_DIGEST" "$REPO/rho/approval-grants/$REQUEST_ID/$ACTION_ID.yaml"
grep -q "dataset_uuid: $DATASET_UUID" "$REPO/rho/approval-grants/$REQUEST_ID/$ACTION_ID.yaml"
if grep -q "$PRIVATE_ROOT" "$REPO/rho/approval-grants/$REQUEST_ID/$ACTION_ID.yaml"; then
  echo "committed approval grant leaked private root path" >&2
  exit 1
fi
grep -q "$INPUT_DIGEST" "$REPO/$RECEIPT_DIR/$RUN_ID.yaml"
grep -q "$CODE_DIGEST" "$REPO/$RECEIPT_DIR/$RUN_ID.yaml"
grep -q "rho/messages/inbox/id/github/rho-collab/$REQUEST_ID/result.yaml" "$REPO/$RECEIPT_DIR/$RUN_ID.yaml"
if grep -q "$PRIVATE_ROOT" "$REPO/$RECEIPT_DIR/$RUN_ID.yaml"; then
  echo "committed run receipt leaked private root path" >&2
  exit 1
fi
RHO_HOME="$OWNER_HOME" ./rho crypto verify \
  "$REPO/.rho/action-grants/$ACTION_ID.yaml" \
  --signature "$REPO/.rho/action-grants/$ACTION_ID.rhosig.yaml" \
  --identity "$OWNER_ID" \
  --repo-id rho://repo/local/run-approve \
  --request-id "$REQUEST_ID" \
  --recipient "$COLLAB_ID" \
  --purpose rho.local_action_grant >/dev/null
RHO_HOME="$OWNER_HOME" ./rho crypto verify \
  "$REPO/rho/approval-grants/$REQUEST_ID/$ACTION_ID.yaml" \
  --signature "$REPO/rho/approval-grants/$REQUEST_ID/$ACTION_ID.rhosig.yaml" \
  --identity "$OWNER_ID" \
  --repo-id rho://repo/local/run-approve \
  --request-id "$REQUEST_ID" \
  --recipient "$COLLAB_ID" \
  --purpose rho.approval_grant >/dev/null
RHO_HOME="$OWNER_HOME" ./rho crypto verify \
  "$REPO/$RECEIPT_DIR/$RUN_ID.yaml" \
  --signature "$REPO/$RECEIPT_DIR/$RUN_ID.rhosig.yaml" \
  --identity "$OWNER_ID" \
  --repo-id rho://repo/local/run-approve \
  --request-id "$REQUEST_ID" \
  --recipient "$COLLAB_ID" \
  --purpose rho.run_receipt >/dev/null
grep -q "purpose: rho.local_action_grant" "$REPO/.rho/action-grants/$ACTION_ID.rhosig.yaml"
grep -q "purpose: rho.approval_grant" "$REPO/rho/approval-grants/$REQUEST_ID/$ACTION_ID.rhosig.yaml"
grep -q "purpose: rho.run_receipt" "$REPO/$RECEIPT_DIR/$RUN_ID.rhosig.yaml"
grep -q "\"action_id\": \"$ACTION_ID\"" "$REPO/.rho/control/outbox/$ACTION_ID.json"
grep -q "tool_id: run_real" "$REPO/.rho/requests/$REQUEST_ID.yaml"

echo "inspect sandbox: $SANDBOX"
find "$SANDBOX" \
  -path "*/.git" -prune -o \
  -maxdepth 7 -type f -print | sort
echo "rho run approve-request e2e passed"
