#!/bin/bash
# Round01.5 Phase 1/2 local QA:
# - Entitlement model unit tests
# - App target build and authorization report field smoke test
# - Fixture state coverage
# - Release manifest template validity
# - Formal release script refuses missing Developer ID / notarization config

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
OUTPUT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
SOURCE_ROOT="$OUTPUT_ROOT/C1.source"
# shellcheck source=build-output-paths.sh
source "$SCRIPT_DIR/build-output-paths.sh"

APP="$BUILD_CURRENT_APP"
REPORT="$BUILD_REPORT_ROOT/round015-entitlement-fixture-qa.json"
AUTHORIZATION_REPORT="$BUILD_REPORT_ROOT/round015-authorization-report.json"
SWIFT_TEST_LOG="$BUILD_REPORT_ROOT/round015-entitlement-swift-test.log"
SWIFT_BUILD_LOG="$BUILD_REPORT_ROOT/round015-swift-build.log"
RELEASE_MISSING_LOG="$BUILD_REPORT_ROOT/round015-release-missing-config.log"
RELEASE_CONFIG_LOG="$BUILD_REPORT_ROOT/round015-release-config.log"
MANIFEST_LOG="$BUILD_REPORT_ROOT/round015-generate-release-manifest.log"
REPORT_WAIT="${ALIGNER_ROUND015_REPORT_WAIT:-12.0}"
APP_PID=""

fail() {
  echo "round015-entitlement-fixture-qa.sh failed: $*" >&2
  exit 1
}

aligner_pids_for_current_app() {
  ps -axo pid=,args= | while read -r pid command; do
    if [[ "$command" == "$APP/Contents/MacOS/Aligner"* ]]; then
      echo "$pid"
    fi
  done
}

stop_current_aligner() {
  for pid in $(aligner_pids_for_current_app); do
    kill "$pid" 2>/dev/null || true
  done

  for _ in {1..30}; do
    [ -z "$(aligner_pids_for_current_app)" ] && return
    sleep 0.1
  done

  fail "current Aligner app did not exit before QA"
}

cleanup() {
  if [ -n "${APP_PID:-}" ]; then
    kill "$APP_PID" 2>/dev/null || true
    wait "$APP_PID" 2>/dev/null || true
    APP_PID=""
  fi
  stop_current_aligner
}

trap cleanup EXIT

run_swift_tests() {
  (
    cd "$SOURCE_ROOT"
    swift test --filter EntitlementPolicyTests
  ) >"$SWIFT_TEST_LOG" 2>&1 || {
    head -c 6000 "$SWIFT_TEST_LOG" >&2
    fail "EntitlementPolicyTests failed"
  }
}

run_app_build() {
  (
    cd "$SOURCE_ROOT"
    swift build -c debug
  ) >"$SWIFT_BUILD_LOG" 2>&1 || {
    head -c 6000 "$SWIFT_BUILD_LOG" >&2
    fail "swift build failed"
  }
}

validate_manifest_templates() {
  /usr/bin/python3 -m json.tool "$SCRIPT_DIR/release-manifest-template.json" >/dev/null
  /usr/bin/python3 -m json.tool "$SCRIPT_DIR/public-latest-manifest-template.json" >/dev/null
}

validate_release_guardrails() {
  if (
    unset ALIGNER_DEVELOPER_IDENTITY ALIGNER_NOTARY_PROFILE ALIGNER_RELEASE_GITHUB_REPOSITORY
    "$SCRIPT_DIR/release-app.sh" --check-config
  ) >"$RELEASE_MISSING_LOG" 2>&1; then
    fail "release-app.sh must reject missing Developer ID config"
  fi

  rg -q "ALIGNER_DEVELOPER_IDENTITY" "$RELEASE_MISSING_LOG" \
    || fail "release missing-config log must mention ALIGNER_DEVELOPER_IDENTITY"

  ALIGNER_DEVELOPER_IDENTITY="Developer ID Application: Fixture (TEAMID)" \
    ALIGNER_NOTARY_PROFILE="fixture-profile" \
    ALIGNER_RELEASE_GITHUB_REPOSITORY="fixture/aligner" \
    "$SCRIPT_DIR/release-app.sh" --check-config >"$RELEASE_CONFIG_LOG" 2>&1 \
    || {
      head -c 6000 "$RELEASE_CONFIG_LOG" >&2
      fail "release-app.sh --check-config should accept complete fixture config"
    }
}

release_dir_for_current_version() {
  local version
  local build

  version="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$SOURCE_ROOT/Resources/Aligner-Info.plist" 2>/dev/null)" \
    || fail "unable to read CFBundleShortVersionString"
  build="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleVersion' "$SOURCE_ROOT/Resources/Aligner-Info.plist" 2>/dev/null)" \
    || fail "unable to read CFBundleVersion"
  printf '%s/Aligner-%s-build%s\n' "$BUILD_ROOT" "$version" "$build"
}

validate_manifest_generation() {
  local release_dir
  release_dir="$(release_dir_for_current_version)"

  "$SCRIPT_DIR/generate-release-manifest.sh" "$release_dir" >"$MANIFEST_LOG" 2>&1 || {
    head -c 6000 "$MANIFEST_LOG" >&2
    fail "generate-release-manifest.sh failed"
  }

  /usr/bin/python3 - "$release_dir/release-manifest.json" "$release_dir/public-latest.json" <<'PY'
import json
import pathlib
import sys

internal_path = pathlib.Path(sys.argv[1])
public_path = pathlib.Path(sys.argv[2])
internal = json.loads(internal_path.read_text(encoding="utf-8"))
public = json.loads(public_path.read_text(encoding="utf-8"))

def fail(message):
    print(json.dumps({"internal": internal, "public": public}, indent=2, ensure_ascii=False), file=sys.stderr)
    print(message, file=sys.stderr)
    sys.exit(1)

if internal.get("product") != "Aligner" or public.get("product") != "Aligner":
    fail("manifest product must be Aligner")
if internal.get("version") != public.get("version"):
    fail("internal/public version must match")
if internal.get("build") != public.get("build"):
    fail("internal/public build must match")
expected_tag = f"v{internal.get('version')}-build{internal.get('build')}"
if internal.get("expectedGitTag") != expected_tag:
    fail("internal expectedGitTag must match version/build")
if internal.get("gitTag") not in ("", expected_tag):
    fail("internal gitTag must be empty or match expectedGitTag")
if internal.get("dmgSHA256") != public.get("sha256"):
    fail("internal/public SHA must match")
if public.get("notarized") is not False:
    fail("public manifest must not claim notarized without explicit release env")
if public.get("downloadURL") != "":
    fail("public manifest must not invent a download URL")
if "license" in json.dumps(internal, ensure_ascii=False).lower():
    fail("release manifest must not contain license material")
PY
}

wait_for_authorization_report() {
  /usr/bin/python3 - "$AUTHORIZATION_REPORT" "$REPORT_WAIT" <<'PY'
import json
import sys
import time

path = sys.argv[1]
timeout = float(sys.argv[2])
deadline = time.time() + timeout
last_report = None

while time.time() < deadline:
    try:
        with open(path, "r", encoding="utf-8") as file:
            report = json.load(file)
        last_report = report
        auth = report.get("authorization", {})
        if auth.get("fixtureState") == "trialActive":
            sys.exit(0)
    except FileNotFoundError:
        pass
    except json.JSONDecodeError:
        pass
    time.sleep(0.1)

if last_report is not None:
    print(json.dumps(last_report, indent=2, ensure_ascii=False), file=sys.stderr)
print("authorization report did not become ready", file=sys.stderr)
sys.exit(1)
PY
}

assert_authorization_report() {
  /usr/bin/python3 - "$AUTHORIZATION_REPORT" <<'PY'
import json
import sys

with open(sys.argv[1], "r", encoding="utf-8") as file:
    report = json.load(file)

def fail(message):
    print(json.dumps(report, indent=2, ensure_ascii=False), file=sys.stderr)
    print(message, file=sys.stderr)
    sys.exit(1)

auth = report.get("authorization")
if not isinstance(auth, dict):
    fail("authorization report must be an object")
if auth.get("fixtureState") != "trialActive":
    fail("authorization.fixtureState must be trialActive")
if auth.get("state") != "trialActive":
    fail("authorization.state must be trialActive")
if auth.get("proFeature") != "windowShortcutActivation":
    fail("authorization.proFeature must be windowShortcutActivation")
if auth.get("proFeatureUnlocked") is not True:
    fail("trialActive must unlock the Pro feature in report")
if auth.get("licenseKeyPresent") is not False:
    fail("trialActive fixture without debug key must not report licenseKeyPresent")
if "fixture-valid-key" in json.dumps(report, ensure_ascii=False):
    fail("report must not contain fixture plaintext license material")
PY
}

run_authorization_report_smoke() {
  "$SCRIPT_DIR/package-app.sh" >/dev/null
  stop_current_aligner
  rm -f "$AUTHORIZATION_REPORT"

  "$APP/Contents/MacOS/Aligner" \
    --round0-skip-permissions \
    --round01-open-quick-switch \
    --round01-fixture-app-count=1 \
    --round01-fixture-windows-per-app=1 \
    --round01-disable-screenshot-refresh \
    --round01-quick-switch-report="$AUTHORIZATION_REPORT" \
    --round015-license-state=trialActive \
    --round015-now=2026-06-24T00:00:00Z &

  APP_PID=$!
  wait_for_authorization_report
  assert_authorization_report

  kill "$APP_PID" 2>/dev/null || true
  wait "$APP_PID" 2>/dev/null || true
  APP_PID=""
}

write_report() {
  /usr/bin/python3 - "$REPORT" "$SWIFT_TEST_LOG" "$SWIFT_BUILD_LOG" "$AUTHORIZATION_REPORT" "$RELEASE_MISSING_LOG" "$RELEASE_CONFIG_LOG" <<'PY'
import json
import os
import pathlib
import sys
from datetime import datetime, timezone

report = {
    "qa": "round015-entitlement-fixture",
    "createdAt": datetime.now(timezone.utc).isoformat(),
    "checks": {
        "entitlementPolicyTests": "passed",
        "swiftBuild": "passed",
        "authorizationReportFixture": "passed",
        "releaseManifestTemplates": "passed",
        "releaseManifestGeneration": "passed",
        "releaseGuardRejectsMissingDeveloperID": "passed",
        "releaseGuardAcceptsCompleteFixtureConfig": "passed",
        "sensitiveLicenseMaterialInReport": "absent",
    },
    "logs": {
        "swiftTest": sys.argv[2],
        "swiftBuild": sys.argv[3],
        "authorizationReport": sys.argv[4],
        "releaseMissingConfig": sys.argv[5],
        "releaseConfig": sys.argv[6],
        "manifestGeneration": os.environ.get("ROUND015_MANIFEST_LOG", ""),
    },
}
pathlib.Path(sys.argv[1]).write_text(json.dumps(report, indent=2, ensure_ascii=False) + "\n")
PY
}

run_swift_tests
run_app_build
validate_manifest_templates
validate_release_guardrails
run_authorization_report_smoke
validate_manifest_generation
ROUND015_MANIFEST_LOG="$MANIFEST_LOG" \
write_report

echo "Round01.5 entitlement fixture QA passed"
echo "Report: $REPORT"