#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT_DIR"

SANDBOX="$ROOT_DIR/sandbox/rho-check-pr"
REPO="$SANDBOX/repo"
NON_RHO_REPO="$SANDBOX/non-rho-repo"
OWNER_ID="rho://id/github/rho-owner"
MEMBER_ID="rho://id/github/rho-member"
UNKNOWN_ID="rho://id/github/rho-guest"
BLOCKED_ID="rho://id/github/rho-blocked"

json_field() {
  local file="$1"
  local expr="$2"
  python3 - "$file" "$expr" <<'PY'
import json
import sys

path, expr = sys.argv[1], sys.argv[2]
value = json.load(open(path))
for part in expr.split("."):
    value = value[part]
if isinstance(value, bool):
    print(str(value).lower())
else:
    print(value)
PY
}

run_check() {
  local name="$1"
  local actor="$2"
  shift 2
  ./rho repo check-pr \
    --root "$REPO" \
    --actor "$actor" \
    --format json \
    "$@" > "$SANDBOX/$name.json"
}

rm -rf "$SANDBOX"
mkdir -p "$REPO"
git -C "$REPO" init >/dev/null
git -C "$REPO" config user.name "Rho Check PR Test"
git -C "$REPO" config user.email "rho-check-pr@example.test"
git -C "$REPO" config commit.gpgsign false
git -C "$REPO" switch -c main >/dev/null

./rho repo init \
  --root "$REPO" \
  --repo-id rho://repo/local/check-pr \
  --owner "$OWNER_ID" \
  --yes >/dev/null
cat > "$REPO/rho/membership.yaml" <<EOF
version: 1
members:
  - identity: $OWNER_ID
    role: owner
  - identity: $MEMBER_ID
    role: collaborator
EOF
cat > "$REPO/rho/policy/revocations.yaml" <<EOF
version: 1
revocations:
  - identity: $BLOCKED_ID
    decision: blocked
EOF
git -C "$REPO" add . >/dev/null
git -C "$REPO" commit -m "Initialize Rho check-pr fixture" >/dev/null

run_check admin-policy "$OWNER_ID" \
  --changed-file rho/policy/auth.yaml
test "$(json_field "$SANDBOX/admin-policy.json" status)" = "pass"
test "$(json_field "$SANDBOX/admin-policy.json" role)" = "admin"

run_check member-code "$MEMBER_ID" \
  --changed-file workspace/sum_prices.py \
  --changed-file rho/requests/req-11111111-1111-1111-1111-111111111111.yaml
test "$(json_field "$SANDBOX/member-code.json" status)" = "pass"
test "$(json_field "$SANDBOX/member-code.json" role)" = "member"

run_check member-policy "$MEMBER_ID" \
  --changed-file rho/policy/auth.yaml
test "$(json_field "$SANDBOX/member-policy.json" status)" = "blocked"
test "$(json_field "$SANDBOX/member-policy.json" close_recommended)" = "true"
grep -q "only admins" "$SANDBOX/member-policy.json"

run_check unknown-join "$UNKNOWN_ID" \
  --changed-file rho/participants/rho-guest.yaml \
  --changed-file rho/requests/join-rho-guest.yaml
test "$(json_field "$SANDBOX/unknown-join.json" status)" = "pending"
test "$(json_field "$SANDBOX/unknown-join.json" role)" = "unknown"

run_check unknown-code "$UNKNOWN_ID" \
  --changed-file workspace/sum_prices.py
test "$(json_field "$SANDBOX/unknown-code.json" status)" = "blocked"
grep -q "unknown actors may only submit" "$SANDBOX/unknown-code.json"

run_check blocked "$BLOCKED_ID" \
  --changed-file workspace/sum_prices.py
test "$(json_field "$SANDBOX/blocked.json" status)" = "blocked"
test "$(json_field "$SANDBOX/blocked.json" role)" = "blocked"
grep -q "actor is blocked" "$SANDBOX/blocked.json"

cat > "$SANDBOX/event.json" <<EOF
{
  "pull_request": {
    "user": {
      "login": "rho-member"
    }
  },
  "rho_changed_files": [
    "workspace/event.py"
  ]
}
EOF
./rho repo check-pr \
  --root "$REPO" \
  --event "$SANDBOX/event.json" \
  --format json > "$SANDBOX/event.json.out"
test "$(json_field "$SANDBOX/event.json.out" actor)" = "$MEMBER_ID"
test "$(json_field "$SANDBOX/event.json.out" status)" = "pass"

mkdir -p "$NON_RHO_REPO"
git -C "$NON_RHO_REPO" init >/dev/null
./rho repo check-pr \
  --root "$NON_RHO_REPO" \
  --event "$SANDBOX/event.json" \
  --format json > "$SANDBOX/non-rho.json"
test "$(json_field "$SANDBOX/non-rho.json" status)" = "pass"
test "$(json_field "$SANDBOX/non-rho.json" role)" = "unmanaged"
grep -q "policy check skipped" "$SANDBOX/non-rho.json"

echo "inspect sandbox: $SANDBOX"
find "$SANDBOX" -maxdepth 3 -type f | sort
echo "rho check-pr e2e passed"
