#!/bin/bash
# Self-contained test for the legacy-path handling in docker-entrypoint.sh.
#
# Runs the real entrypoint with a fake "threshold" binary and temporary
# config paths (via the THRESHOLD_ENTRYPOINT_TEST_* overrides). No Docker or
# root needed. The entrypoint is written for busybox/ash; bash is used here
# because it accepts the same ${var:off:len} syntax.
#
# Usage: .release/docker/test-entrypoint.sh

set -u

HERE=$(cd "$(dirname "$0")" && pwd)
ENTRY="$HERE/docker-entrypoint.sh"
WORK=$(mktemp -d)
trap 'rm -rf "$WORK"' EXIT

FAILS=0
PASSES=0
check() { # check DESC EXPECTED ACTUAL
	if [ "$2" = "$3" ]; then
		PASSES=$((PASSES + 1))
	else
		FAILS=$((FAILS + 1))
		echo "FAIL: $1" >&2
		echo "  expected: $2" >&2
		echo "  actual:   $3" >&2
	fi
}

mkdir -p "$WORK/bin" "$WORK/new" "$WORK/legacy"
# Fake threshold: print the argument vector on one line, "|"-separated.
cat >"$WORK/bin/threshold" <<'EOF'
#!/bin/sh
case "$1" in --help) [ "$2" = threshold ] || echo "threshold $2"; exit 0 ;; esac
IFS='|'
echo "ARGS:$*"
EOF
cat >"$WORK/bin/su-exec" <<'EOF'
#!/bin/sh
shift
exec "$@"
EOF
chmod 755 "$WORK/bin/threshold" "$WORK/bin/su-exec"

NEWCFG="$WORK/new/config.hcl"
LEGCFG="$WORK/legacy/config.hcl"
STOCK="$WORK/stock.hcl"

run() { # run ARGS... ; prints "<stdout-args> || <stderr>"
	PATH="$WORK/bin:$PATH" SKIP_CHOWN=1 SKIP_SETCAP=1 \
		THRESHOLD_ENTRYPOINT_TEST_NEW="$NEWCFG" \
		THRESHOLD_ENTRYPOINT_TEST_LEGACY="$LEGCFG" \
		THRESHOLD_ENTRYPOINT_TEST_STOCK="$STOCK" \
		bash "$ENTRY" "$@" 2>"$WORK/err" | grep '^ARGS:'
}
stderr() { cat "$WORK/err"; }

echo "stock demo config" >"$STOCK"
cp "$STOCK" "$NEWCFG"

# 1. default invocation, stock config, no legacy file -> unchanged, no warning
out=$(run server -config "$NEWCFG")
check "default path kept" "ARGS:server|-config|$NEWCFG" "$out"
check "no warning by default" "" "$(stderr | grep -c deprecated | grep -v '^0$')"

# 2. user's own /threshold config (differs from stock) wins over a legacy file
echo "user threshold config" >"$NEWCFG"
echo "user legacy config" >"$LEGCFG"
out=$(run server -config "$NEWCFG")
check "custom threshold config preferred" "ARGS:server|-config|$NEWCFG" "$out"

# 3. stock /threshold config + user legacy config -> legacy used with warning
cp "$STOCK" "$NEWCFG"
out=$(run server -config "$NEWCFG")
check "legacy config used when threshold is stock" "ARGS:server|-config|$LEGCFG" "$out"
check "deprecation warning printed" "1" "$(stderr | grep -c 'WARNING.*Boundary-era')"

# 4. explicit legacy path that exists -> used with warning
out=$(run server -config "$LEGCFG")
check "explicit legacy path kept" "ARGS:server|-config|$LEGCFG" "$out"
check "explicit legacy warns" "1" "$(stderr | grep -c 'WARNING')"

# 5. explicit legacy path that does not exist -> fall back to threshold path
rm -f "$LEGCFG"
out=$(run server -config "$LEGCFG")
check "missing legacy falls back to threshold" "ARGS:server|-config|$NEWCFG" "$out"

# 6. -config=PATH form
echo "user legacy config" >"$LEGCFG"
out=$(run server -config="$LEGCFG")
check "-config=path form" "ARGS:server|-config=$LEGCFG" "$out"
rm -f "$LEGCFG"
out=$(run server -config="$LEGCFG")
check "-config=path fallback" "ARGS:server|-config=$NEWCFG" "$out"

# 7. legacy command name
out=$(run boundary version)
check "boundary command accepted" "ARGS:version" "$out"
check "boundary command warns" "1" "$(stderr | grep -c "'boundary' command is deprecated")"

# 8. unrelated args untouched
out=$(run database init -config "$NEWCFG" -skip-auth-method-creation)
check "other args preserved" "ARGS:database|init|-config|$NEWCFG|-skip-auth-method-creation" "$out"

echo "passed: $PASSES, failed: $FAILS"
[ "$FAILS" -eq 0 ]