name: test-cli-ui

on:
  workflow_call:
    inputs:
      artifact-name:
        type: string
        required: true

permissions:
  contents: read
  actions: read

jobs:
  bats:
    runs-on: ${{ fromJSON(vars.RUNNER) }}
    name: CLI tests
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set up Bats CLI UI tests dependency cache
        id: dep-cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.3
        with:
          path: /tmp/test-deps
          key: enos-bats-cli-ui-deps-jq-1.6-password-store-1.7.4-vault-1.12.2
      - name: Set up Node for Bats install
        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 16
      - name: Install Bats via NPM
        # Use npm so this workflow is portable on multiple runner distros
        run: npm install --location=global bats
      - name: Download jq for Bats CLI UI tests
        if: steps.dep-cache.outputs.cache-hit != 'true'
        # NOTE: if you update the jq version make sure to update the dep cache key
        run: |
          mkdir -p /tmp/test-deps
          wget https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -O /tmp/test-deps/jq-bin
      - name: Install jq for Bats CLI UI tests
        run: |
          chmod +x /tmp/test-deps/jq-bin
          sudo cp /tmp/test-deps/jq-bin /usr/local/bin/jq
      - name: Download and unzip pass for Boundary keyring
        if: steps.dep-cache.outputs.cache-hit != 'true'
        # NOTE: if you update the password store version make sure to update the dep cache key
        run: |
          mkdir -p /tmp/test-deps/pass
          wget https://github.com/zx2c4/password-store/archive/refs/tags/1.7.4.tar.gz -O /tmp/test-deps/pass/pass.tar.gz
          cd /tmp/test-deps/pass
          tar -xvf pass.tar.gz
      - name: GPG setup
        run: |
          # Create a GPG key
          export KEY_PW=boundary
          gpg --generate-key --batch <<'eoGpgConf'
              %echo Started!
              Key-Type: RSA
              Key-Length: default
              Subkey-Type: RSA
              Name-Real: boundary
              Name-Comment: default
              Name-Email: default
              Expire-Date: 0
              Passphrase: boundary
              %commit
              %echo Done.
          eoGpgConf

          # Enable gpg-preset-passphrase so that key passwords can be saved
          echo "allow-preset-passphrase" >> ~/.gnupg/gpg-agent.conf
          gpg-connect-agent reloadagent /bye &>/dev/null

          # Get information about the created keys
          lines=$(gpg --list-secret-keys --with-colons --with-keygrip)
          export lines
          export KEY_ID=""
          while read -r line
          do
            # Save the first key id to be used later
            if [[ $line =~ "fpr"* ]]; then
              if [[ $KEY_ID == "" ]]; then
                KEY_ID="$(echo "$line" | sed -r 's/fpr|://g')"
              fi
            fi

            # Cache the passphrases for the keys so passwords do not need to be entered
            if [[ $line =~ "grp"* ]]; then
              KEYGRIP_ID="$(echo "$line" | sed -r 's/grp|://g')"
              export KEYGRIP_ID
              /usr/lib/gnupg/gpg-preset-passphrase --preset -P "$KEY_PW" "$KEYGRIP_ID"
            fi
          done <<< "$lines"

          # Trust the key
          touch /tmp/test.txt
          gpg -a --encrypt -r "$KEY_ID" --trust-model always --batch --yes /tmp/test.txt
          echo "trusted-key $KEY_ID" >> ~/.gnupg/gpg.conf

          # Initialize the password store
          sudo apt-get update
          sudo apt-get install -y pass
          pass init "$KEY_ID" &>/dev/null
      - name: Download Vault AMD64 binary for integration testing
        if: steps.dep-cache.outputs.cache-hit != 'true'
        run: |
          wget https://releases.hashicorp.com/vault/1.12.2/vault_1.12.2_linux_amd64.zip -O /tmp/test-deps/vault.zip
      - name: Install Vault
        run: |
          unzip /tmp/test-deps/vault.zip -d /usr/local/bin
      - name: Download Linux AMD64 Boundary bundle
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.1
        with:
          name: ${{ inputs.artifact-name }}
          path: /tmp
      - name: Unpack boundary bundle
        run: |
          unzip -o /tmp/${{ inputs.artifact-name }} -d /usr/local/bin
          rm /tmp/${{ inputs.artifact-name }}
      - name: Versions
        run: |
          echo "bats version:"
          bats --version
          echo "jq version:"
          jq --version
          echo "gpg version:"
          gpg --version
          echo "pass version:"
          pass --version
          echo "bash version:"
          bash --version
          echo "boundary version:"
          boundary version
          echo "vault version:"
          vault version
      - name: Run cli bats tests
        timeout-minutes: 30
        run: |
          export VAULT_ADDR=http://127.0.0.1:8200
          export VAULT_TOKEN=boundarytok
          make -C internal/tests/cli test-vault-up
          until vault status; do docker container inspect boundary-cli-tests-vault &> /dev/null || exit 255; sleep 1; done
          make test-cli
      - name: Cleanup
        if: success() || failure()
        run: |
          make -C internal/tests/cli test-vault-down