#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT_DIR"

SANDBOX="$ROOT_DIR/sandbox/rho-repo-doctor"
REPO="$SANDBOX/repo"
USER1_ID="rho://id/github/rho-owner"
USER2_ID="rho://id/github/rho-collab"
REQUEST_PATH="rho/messages/inbox/rho-owner/request.yaml.rhoenc"

rm -rf "$SANDBOX"
mkdir -p "$REPO"

git -C "$REPO" init >/dev/null
git -C "$REPO" config user.name "Rho Doctor Test"
git -C "$REPO" config user.email "doctor@example.test"
git -C "$REPO" config commit.gpgsign false

./rho repo init \
  --root "$REPO" \
  --repo-id rho://repo/local/doctor \
  --owner "$USER1_ID" >/dev/null

RHO_HOME="$SANDBOX/user1-rho-home" ./rho id init \
  --github rho-owner \
  --display-name "Rho Owner" \
  --generate-ssh-key >/dev/null
RHO_HOME="$SANDBOX/user2-rho-home" ./rho id init \
  --github rho-collab \
  --display-name "Rho Collaborator" \
  --generate-ssh-key >/dev/null

RHO_HOME="$SANDBOX/user1-rho-home" ./rho id export \
  --identity "$USER1_ID" \
  --out "$REPO/rho/participants/rho-owner.yaml" >/dev/null
RHO_HOME="$SANDBOX/user2-rho-home" ./rho id export \
  --identity "$USER2_ID" \
  --out "$REPO/rho/participants/rho-collab.yaml" >/dev/null

cat > "$REPO/rho/membership.yaml" <<EOF
version: 1
members:
  - identity: $USER1_ID
    role: owner
  - identity: $USER2_ID
    role: collaborator
EOF

cat > "$REPO/rho/policy/permissions.yaml" <<EOF
version: 1
permissions:
  - id: owner_inbox
    pattern: rho/messages/inbox/rho-owner/**
    write:
      allowed:
        - members
    read:
      encrypted_to:
        - $USER1_ID
EOF
cat > "$REPO/rho/policy/crypto.yaml" <<EOF
version: 1
crypto:
  signatures: ssh
  encryption: x25519-recipient-envelope
  transparent_git_filters: enabled
  filter: rho-crypt
EOF
printf "rho/messages/inbox/rho-owner/** filter=rho-crypt diff=rho-crypt\n" >> "$REPO/.gitattributes"

RHO_HOME="$SANDBOX/user2-rho-home" ./rho id import \
  "$REPO/rho/participants/rho-owner.yaml" >/dev/null
mkdir -p "$REPO/rho/messages/inbox/rho-owner"
cat > "$SANDBOX/request.yaml" <<EOF
version: 1
request:
  note: private request for owner
EOF
RHO_HOME="$SANDBOX/user2-rho-home" ./rho crypto seal \
  "$SANDBOX/request.yaml" \
  --recipient "$USER1_ID" \
  --out "$REPO/$REQUEST_PATH" >/dev/null

DATASET_UUID="77777777-8888-9999-aaaa-bbbbbbbbbbbb"
mkdir -p "$REPO/datasets/public/$DATASET_UUID/mock"
printf "date,symbol,price\n2026-06-15,RHO,1.00\n" > "$REPO/datasets/public/$DATASET_UUID/mock/prices-mock.csv"
MOCK_SHA256="$(shasum -a 256 "$REPO/datasets/public/$DATASET_UUID/mock/prices-mock.csv" | awk '{print $1}')"
cat > "$REPO/datasets/public/$DATASET_UUID/dataset.yaml" <<EOF
version: 1
dataset:
  uuid: $DATASET_UUID
  name: doctor-dataset
  owner: $USER1_ID
  variants:
    mock:
      tier: mock
      relative_path: mock/prices-mock.csv
      file_name: prices-mock.csv
      mime_type: text/csv
      sha256: $MOCK_SHA256
    real:
      tier: real
      availability: private
      staged_under_user_folder: true
EOF

git -C "$REPO" add .gitattributes rho datasets
RHO_HOME="$SANDBOX/user1-rho-home" ./rho repo doctor --root "$REPO" >"$SANDBOX/doctor-pass.txt"
grep -q "rho repo doctor passed" "$SANDBOX/doctor-pass.txt"

RHO_HOME="$SANDBOX/user1-rho-home" ./rho repo sign-governance --root "$REPO" >"$SANDBOX/sign-governance.txt"
test -f "$REPO/rho/membership.rhosig.yaml"
test -f "$REPO/rho/policy/permissions.rhosig.yaml"
test -f "$REPO/datasets/public/$DATASET_UUID/dataset.rhosig.yaml"
RHO_HOME="$SANDBOX/user1-rho-home" ./rho repo doctor --root "$REPO" --governance >"$SANDBOX/doctor-governance-pass.txt"
grep -q "governance: passed" "$SANDBOX/doctor-governance-pass.txt"

printf "\n# tampered after governance signing\n" >> "$REPO/rho/membership.yaml"
if RHO_HOME="$SANDBOX/user1-rho-home" ./rho repo doctor --root "$REPO" --governance >"$SANDBOX/doctor-governance-fail-stdout.txt" 2>"$SANDBOX/doctor-governance-fail-stderr.txt"; then
  echo "doctor allowed tampered governance manifest" >&2
  exit 1
fi
grep -q "signature verification failed" "$SANDBOX/doctor-governance-fail-stderr.txt"
RHO_HOME="$SANDBOX/user1-rho-home" ./rho repo sign-governance --root "$REPO" >"$SANDBOX/resign-governance.txt"

cat > "$REPO/datasets/public/$DATASET_UUID/dataset.yaml" <<EOF
version: 1
dataset:
  uuid: $DATASET_UUID
  owner: $USER1_ID
  name: doctor-dataset
  mock_path: datasets/public/$DATASET_UUID/mock/prices-mock.csv
  real_tier: private
EOF
if RHO_HOME="$SANDBOX/user1-rho-home" ./rho repo doctor --root "$REPO" >"$SANDBOX/doctor-dataset-fail-stdout.txt" 2>"$SANDBOX/doctor-dataset-fail-stderr.txt"; then
  echo "doctor allowed malformed dataset manifest" >&2
  exit 1
fi
grep -q "missing dataset.variants" "$SANDBOX/doctor-dataset-fail-stderr.txt"
cat > "$REPO/datasets/public/$DATASET_UUID/dataset.yaml" <<EOF
version: 1
dataset:
  uuid: $DATASET_UUID
  name: doctor-dataset
  owner: $USER1_ID
  variants:
    mock:
      tier: mock
      relative_path: mock/prices-mock.csv
      file_name: prices-mock.csv
      mime_type: text/csv
      sha256: $MOCK_SHA256
    real:
      tier: real
      availability: private
      staged_under_user_folder: true
EOF

cat > "$REPO/rho/policy/crypto.yaml" <<EOF
version: 1
crypto:
  signatures: ssh
  encryption: x25519-recipient-envelope
  transparent_git_filters: disabled
EOF
if RHO_HOME="$SANDBOX/user1-rho-home" ./rho repo doctor --root "$REPO" >"$SANDBOX/doctor-crypto-fail-stdout.txt" 2>"$SANDBOX/doctor-crypto-fail-stderr.txt"; then
  echo "doctor allowed contradictory crypto filter policy" >&2
  exit 1
fi
grep -q "crypto.transparent_git_filters is disabled but .gitattributes uses filter=rho-crypt" "$SANDBOX/doctor-crypto-fail-stderr.txt"
cat > "$REPO/rho/policy/crypto.yaml" <<EOF
version: 1
crypto:
  signatures: ssh
  encryption: x25519-recipient-envelope
  transparent_git_filters: enabled
  filter: rho-crypt
EOF

cat > "$REPO/rho/messages/inbox/rho-owner/plaintext.yaml" <<EOF
version: 1
request:
  note: this should have been encrypted
EOF
if RHO_HOME="$SANDBOX/user1-rho-home" ./rho repo doctor --root "$REPO" >"$SANDBOX/doctor-fail-stdout.txt" 2>"$SANDBOX/doctor-fail-stderr.txt"; then
  echo "doctor allowed plaintext protected path" >&2
  exit 1
fi
grep -q "private-read file is not encrypted: rho/messages/inbox/rho-owner/plaintext.yaml" "$SANDBOX/doctor-fail-stderr.txt"

echo "inspect sandbox: $SANDBOX"
find "$SANDBOX" \
  -path "*/.git" -prune -o \
  -maxdepth 7 -type f -print | sort
echo "rho repo doctor e2e passed"
