#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT_DIR"

SANDBOX="$ROOT_DIR/sandbox/rho-refresh-protected"
REMOTE="$SANDBOX/remote.git"
OWNER="$SANDBOX/owner"
FRESH="$SANDBOX/fresh-collab"
OWNER_HOME="$SANDBOX/owner-rho-home"
COLLAB_HOME="$SANDBOX/collab-rho-home"
OWNER_ID="rho://id/github/rho-owner"
COLLAB_ID="rho://id/github/rho-collab"
RESULT_PATH="rho/messages/inbox/rho-collab/req-refresh/result.yaml"

setup_git_user() {
  local repo="$1"
  local name="$2"
  local email="$3"
  git -C "$repo" config user.name "$name"
  git -C "$repo" config user.email "$email"
  git -C "$repo" config commit.gpgsign false
}

rm -rf "$SANDBOX"
mkdir -p "$SANDBOX"

git init --bare "$REMOTE" >/dev/null

RHO_HOME="$OWNER_HOME" ./rho id init \
  --github rho-owner \
  --display-name "Rho Owner" \
  --generate-ssh-key >/dev/null
RHO_HOME="$COLLAB_HOME" ./rho id init \
  --github rho-collab \
  --display-name "Rho Collaborator" \
  --generate-ssh-key >/dev/null
RHO_HOME="$OWNER_HOME" ./rho id export \
  --identity "$OWNER_ID" \
  --out "$SANDBOX/rho-owner-public.yaml" >/dev/null
RHO_HOME="$COLLAB_HOME" ./rho id export \
  --identity "$COLLAB_ID" \
  --out "$SANDBOX/rho-collab-public.yaml" >/dev/null
RHO_HOME="$OWNER_HOME" ./rho id import "$SANDBOX/rho-collab-public.yaml" >/dev/null

git clone "$REMOTE" "$OWNER" >/dev/null
setup_git_user "$OWNER" "Rho Owner" "owner@example.test"
git -C "$OWNER" switch -c main >/dev/null

./rho repo init \
  --root "$OWNER" \
  --repo-id rho://repo/local/refresh-protected \
  --owner "$OWNER_ID" >/dev/null
RHO_HOME="$OWNER_HOME" ./rho id export \
  --identity "$OWNER_ID" \
  --out "$OWNER/rho/participants/rho-owner.yaml" >/dev/null
RHO_HOME="$COLLAB_HOME" ./rho id export \
  --identity "$COLLAB_ID" \
  --out "$OWNER/rho/participants/rho-collab.yaml" >/dev/null
cat > "$OWNER/rho/membership.yaml" <<EOF
version: 1
members:
  - identity: $OWNER_ID
    role: owner
  - identity: $COLLAB_ID
    role: collaborator
EOF

RHO_HOME="$OWNER_HOME" ./rho repo protect-path \
  "rho/messages/inbox/rho-collab/**" \
  --root "$OWNER" \
  --rho-bin "$ROOT_DIR/rho" \
  --recipient "$COLLAB_ID" >/dev/null

mkdir -p "$OWNER/$(dirname "$RESULT_PATH")"
cat > "$OWNER/$RESULT_PATH" <<EOF
version: 1
result:
  request_id: req-refresh
  from: $OWNER_ID
  to: $COLLAB_ID
  total: 1113.03
EOF

RHO_HOME="$OWNER_HOME" git -C "$OWNER" add .gitattributes .gitignore rho rho.yaml
git -C "$OWNER" show ":$RESULT_PATH" > "$SANDBOX/result-index.yaml"
grep -q "kind: rho_recipient_envelope" "$SANDBOX/result-index.yaml"
if grep -q "1113.03" "$SANDBOX/result-index.yaml"; then
  echo "result index blob leaked plaintext" >&2
  exit 1
fi
git -C "$OWNER" commit -m "Publish encrypted result" >/dev/null
git -C "$OWNER" push -u origin main >/dev/null
git -C "$REMOTE" symbolic-ref HEAD refs/heads/main

git clone "$REMOTE" "$FRESH" >/dev/null
setup_git_user "$FRESH" "Rho Collaborator" "collab@example.test"
grep -q "kind: rho_recipient_envelope" "$FRESH/$RESULT_PATH"
if grep -q "1113.03" "$FRESH/$RESULT_PATH"; then
  echo "fresh clone unexpectedly smudged protected file before filters were installed" >&2
  exit 1
fi

RHO_HOME="$COLLAB_HOME" ./rho repo refresh-protected \
  --root "$FRESH" \
  --rho-bin "$ROOT_DIR/rho" \
  > "$SANDBOX/refresh-output.txt"
grep -q "refreshed protected file: $RESULT_PATH" "$SANDBOX/refresh-output.txt"
grep -q "refreshed protected files: 1" "$SANDBOX/refresh-output.txt"

grep -q "1113.03" "$FRESH/$RESULT_PATH"
if grep -q "kind: rho_recipient_envelope" "$FRESH/$RESULT_PATH"; then
  echo "refresh-protected left recipient envelope in working tree" >&2
  exit 1
fi

git -C "$FRESH" show "HEAD:$RESULT_PATH" > "$SANDBOX/result-commit.yaml"
grep -q "kind: rho_recipient_envelope" "$SANDBOX/result-commit.yaml"
if grep -q "1113.03" "$SANDBOX/result-commit.yaml"; then
  echo "committed result blob leaked plaintext" >&2
  exit 1
fi

echo "inspect sandbox: $SANDBOX"
find "$SANDBOX" \
  -path "*/.git" -prune -o \
  -path "*/remote.git" -prune -o \
  -maxdepth 7 -type f -print | sort
echo "rho refresh protected e2e passed"
