/**
 * Regression guard: self-deploy.sh must not trace secrets into its log.
 *
 * The script runs under `set -Eeuxo pipefail`. The `-x` is deliberate — the
 * header explains it was added after 17 hours of blind Hetzner deploy
 * failures — and its own comment states the trace is captured into $LOG by
 * the detached re-exec's `>>"$LOG" 2>&1`.
 *
 * With xtrace active, bash traces every assignment performed by a sourced
 * file. So `set -a; source /etc/gluecron.env` wrote the whole env file to
 * stderr, and on the live box that file holds GOOGLE_OAUTH_CLIENT_SECRET
 * while the log sits at mode 0644 — world-readable. The four curl calls that
 * pass `Bearer $DEPLOY_EVENT_TOKEN` on the command line traced the token the
 * same way, two of them redirecting straight into $LOG.
 *
 * Verified read-only on the box that NO secrets had actually leaked: the log
 * contained zero xtrace lines and zero matches for any credential pattern.
 * The hazard was live in the code, the exposure had not occurred.
 *
 * Also verified: the script is NOT currently reachable. post-receive.ts only
 * dispatches when process.env.SELF_HOST_REPO matches, and that variable is
 * absent from the container the app runs in; no systemd unit invokes it
 * either. It is kept rather than deleted because admin-diagnose and the
 * runbook still present it as the self-host path — and a dormant script is
 * the one most likely to be switched back on without a fresh review, which
 * is precisely why the holes were worth closing.
 */

import { describe, it, expect } from "bun:test";
import { readFileSync } from "node:fs";
import { join } from "node:path";

const src = (() => {
  const raw = readFileSync(
    join(import.meta.dir, "..", "..", "scripts", "self-deploy.sh"),
    "utf8"
  );
  expect(raw.length).toBeGreaterThan(0);
  return raw;
})();

/** Slice by anchor, never by character count. */
function slice(startAnchor: string, endAnchor: string): string {
  const start = src.indexOf(startAnchor);
  expect(start).toBeGreaterThan(-1);
  const end = src.indexOf(endAnchor, start + startAnchor.length);
  expect(end).toBeGreaterThan(start);
  const body = src.slice(start, end);
  expect(body.length).toBeGreaterThan(0);
  return body;
}

describe("self-deploy.sh keeps xtrace on for debuggability", () => {
  it("still traces by default — the fix must not blind the deploy", () => {
    // Removing -x entirely would "fix" the leak by discarding the diagnostic
    // the script exists to provide. The fix is scoped suppression, not that.
    expect(src).toContain("set -Eeuxo pipefail");
  });
});

describe("secrets are not traced", () => {
  it("disables xtrace across the env-file source", () => {
    const body = slice('if [ -f "$ENV_FILE" ]; then', "log \"    v sourced");
    const offAt = body.indexOf("set +x");
    const sourceAt = body.indexOf('source "$ENV_FILE"');
    expect(offAt).toBeGreaterThan(-1);
    expect(sourceAt).toBeGreaterThan(-1);
    expect(offAt).toBeLessThan(sourceAt);
  });

  it("re-enables xtrace after the source, so later steps stay traced", () => {
    const body = slice('if [ -f "$ENV_FILE" ]; then', "log \"    v sourced");
    const sourceAt = body.indexOf('source "$ENV_FILE"');
    const onAt = body.lastIndexOf("set -x");
    expect(onAt).toBeGreaterThan(sourceAt);
  });

  it("has xtrace OFF at every bearer-token curl", () => {
    // Track the flag rather than peeking at a fixed window: one `set +x` can
    // legitimately cover several call sites (the finished-notify guards both
    // its success and failure branches), and a window scan wrongly flags
    // that. Walk the file and assert the state at each token line.
    const lines = src.split("\n");
    let tracing = false;
    let tokenLines = 0;

    for (const line of lines) {
      const t = line.trim();
      if (t === "set -Eeuxo pipefail" || t === "set -x") tracing = true;
      else if (t === "set +x") tracing = false;

      if (line.includes("Bearer $DEPLOY_EVENT_TOKEN")) {
        tokenLines++;
        expect(tracing).toBe(false);
      }
    }

    // Guards against the loop passing vacuously if the calls are renamed.
    expect(tokenLines).toBeGreaterThanOrEqual(4);
  });

  it("has xtrace OFF at the env-file source", () => {
    const lines = src.split("\n");
    let tracing = false;
    let sourceSeen = 0;

    for (const line of lines) {
      const t = line.trim();
      if (t === "set -Eeuxo pipefail" || t === "set -x") tracing = true;
      else if (t === "set +x") tracing = false;

      if (line.includes('source "$ENV_FILE"')) {
        sourceSeen++;
        expect(tracing).toBe(false);
      }
    }
    expect(sourceSeen).toBe(1);
  });

  it("balances every suppression with a re-enable", () => {
    const off = (src.match(/^\s*set \+x\s*$/gm) || []).length;
    const on = (src.match(/^\s*set -x\s*$/gm) || []).length;
    expect(off).toBeGreaterThan(0);
    expect(on).toBe(off);
  });
});

describe("the trace destination is not world-readable", () => {
  it("creates the log 0600 before anything writes to it", () => {
    expect(src).toContain("umask 077");
    expect(src).toContain('chmod 600 "$LOG"');
    // Must happen before the first log() call, or the first write creates
    // the file with the default mode.
    const chmodAt = src.indexOf('chmod 600 "$LOG"');
    const firstLogAt = src.indexOf('log "==> gluecron self-deploy starting');
    expect(chmodAt).toBeGreaterThan(-1);
    expect(firstLogAt).toBeGreaterThan(chmodAt);
  });
});

describe("reachability is documented", () => {
  it("records that the hook does not currently fire this script", () => {
    // A dormant deploy script that reads as live is how it gets re-armed
    // without review.
    expect(src).toContain("SELF_HOST_REPO");
    expect(src).toContain("auto-update.sh");
  });
});