#!/usr/bin/env bash
# Rehearses the air-gapped delivery loop without docker: assemble a signed
# bundle with the real bundler, run install.sh --verify-only against it,
# then tamper and prove the installer refuses before touching anything.
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT

cargo build -q -p clawmates-bundler
BUNDLER="$ROOT/target/debug/clawmates-bundler"

"$BUNDLER" keygen "$WORK/release.key" "$WORK/release.pub"

# Fixture artifacts standing in for image tarballs and compose files.
echo "pretend image bytes" > "$WORK/server.tar"
mkdir -p "$WORK/compose-src"
cp "$ROOT/deploy/compose/docker-compose.yml" "$WORK/compose-src/"
cp "$ROOT/deploy/compose/clawmates.toml" "$WORK/compose-src/"
cp "$ROOT/deploy/compose/.env.example" "$WORK/compose-src/"

"$BUNDLER" assemble "$WORK/bundle" "0.0.0-test" "$WORK/release.key" \
  "$WORK/server.tar=images/server.tar" \
  "$WORK/compose-src/docker-compose.yml=compose/docker-compose.yml" \
  "$WORK/compose-src/clawmates.toml=compose/clawmates.toml" \
  "$WORK/compose-src/.env.example=compose/.env.example" \
  "$BUNDLER=bin/clawmates-bundler"
chmod +x "$WORK/bundle/bin/clawmates-bundler"

# 1. A clean bundle verifies.
"$ROOT/deploy/airgapped/install.sh" "$WORK/bundle" "$WORK/release.pub" --verify-only

# 2. A tampered image is refused.
echo "EVIL" >> "$WORK/bundle/images/server.tar"
if "$ROOT/deploy/airgapped/install.sh" "$WORK/bundle" "$WORK/release.pub" --verify-only 2>/dev/null; then
  echo "FAIL: tampered bundle was accepted"
  exit 1
fi

# 3. The wrong public key is refused.
"$BUNDLER" keygen "$WORK/other.key" "$WORK/other.pub"
if "$ROOT/deploy/airgapped/install.sh" "$WORK/bundle" "$WORK/other.pub" --verify-only 2>/dev/null; then
  echo "FAIL: wrong key was accepted"
  exit 1
fi

echo "install.sh verify path OK"