#!/usr/bin/env bash
# Build an isolated runtime image and verify its public authentication boundary.
set -euo pipefail

image_tag="${IMAGE_TAG:-webfilebrowser:e2e}"
test_suffix="${RANDOM}-$$"
container_name="webfilebrowser-e2e-${test_suffix}"
volume_name="webfilebrowser-e2e-data-${test_suffix}"
work_directory="$(mktemp -d)"

cleanup() {
  docker rm --force "${container_name}" >/dev/null 2>&1 || true
  docker volume rm --force "${volume_name}" >/dev/null 2>&1 || true
  rm -rf "${work_directory}"
}
trap cleanup EXIT

mkdir -p "${work_directory}/media"
cp config/roots.example.json "${work_directory}/roots.json"

docker build --tag "${image_tag}" .
docker volume create "${volume_name}" >/dev/null
docker run --detach --rm --name "${container_name}" \
  --publish 127.0.0.1::8080 \
  --env WEB_FILE_BROWSER_ROOTS_FILE=/etc/webfilebrowser/roots.json \
  --volume "${work_directory}/roots.json:/etc/webfilebrowser/roots.json:ro" \
  --volume "${work_directory}/media:/mnt/media:ro" \
  --volume "${volume_name}:/var/lib/webfilebrowser" \
  "${image_tag}" >/dev/null

port="$(docker port "${container_name}" 8080/tcp | sed -n '1s/.*://p')"
base_url="http://127.0.0.1:${port}"
headers_file="${work_directory}/headers"
body_file="${work_directory}/body"

for _ in {1..30}; do
  if curl --silent --output "${body_file}" --dump-header "${headers_file}" "${base_url}/login"; then
    break
  fi
  sleep 1
done

if ! rg -q '^HTTP/[0-9.]+ 200' "${headers_file}" || ! rg -q 'Sign in' "${body_file}"; then
  docker logs "${container_name}"
  echo "container did not serve the login page" >&2
  exit 1
fi

curl --silent --show-error --output "${body_file}" --dump-header "${headers_file}" "${base_url}/"
if ! rg -q '^HTTP/[0-9.]+ 303' "${headers_file}" || ! rg -qi '^Location: /login' "${headers_file}"; then
  docker logs "${container_name}"
  echo "unauthenticated root request was not redirected to login" >&2
  exit 1
fi

if [[ "$(docker image inspect --format '{{.Config.User}}' "${image_tag}")" != "webfilebrowser" ]]; then
  echo "container image must run as the webfilebrowser user" >&2
  exit 1
fi
docker run --rm --entrypoint /bin/sh "${image_tag}" -c '! command -v go'

echo "production deployment smoke test passed"