#!/usr/bin/env bash
## index-platforms.test.sh — scripts/index-platforms.sh and
## scripts/assemble-multiarch-index.sh (copy of haproxy-manager-base's) against a stub IMAGETOOLS.
set -euo pipefail
HERE=$(cd "$(dirname "$0")/.." && pwd)
T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
fail=0
chk() { if [ "$2" = "$3" ]; then echo "ok   $1"; else echo "FAIL $1: got '$2' want '$3'"; fail=1; fi; }
A=sha256:$(printf 'a%.0s' {1..64}); B=sha256:$(printf 'b%.0s' {1..64}); C=sha256:$(printf 'c%.0s' {1..64})
cat >"$T/it" <<'STUB'
#!/usr/bin/env bash
# index-platforms mode: serves $FIX/<ref-with-/:@ as _> for "inspect --raw REF".
# assemble mode (STUB_LOG set): "inspect REF --format .." -> arch from $ARCHES (ref=arch lines);
#   "create ..." -> appended to $STUB_LOG.
if [ -n "${STUB_LOG:-}" ]; then
  if [ "$1" = create ]; then echo "create $*" >>"$STUB_LOG"; exit 0; fi
  ref=$2; a=$(grep -F -m1 "$ref=" "$ARCHES" | cut -d= -f2); [ -n "$a" ] || exit 1
  printf '{"architecture":"%s"}' "$a"; exit 0
fi
[ "$2" = --raw ] || exit 2
k=$(printf '%s' "$3" | tr '/:@' '___')
if [ -f "$FIX/err_$k" ]; then cat "$FIX/err_$k" >&2; exit 1; fi
[ -f "$FIX/$k" ] || { echo "ERROR: $3: not found" >&2; exit 1; }
cat "$FIX/$k"
STUB
chmod +x "$T/it"; export IMAGETOOLS="$T/it" FIX=$T
w() { printf '%s' "$2" >"$T/$(printf '%s' "$1" | tr '/:@' '___')"; }
w r/i:idx '{"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"digest":"'$A'","platform":{"os":"linux","architecture":"amd64"}},{"digest":"'$B'","platform":{"os":"linux","architecture":"arm64"}},{"digest":"'$C'","platform":{"os":"unknown","architecture":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest"}}]}'
w r/i:amd '{"manifests":[{"digest":"'$A'","platform":{"os":"linux","architecture":"amd64"}},{"digest":"'$C'","platform":{"os":"unknown","architecture":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest"}}]}'
w r/i:one '{"config":{"digest":"'$A'"},"layers":[]}'
w r/i:bad 'garbage'
printf 'ERROR: denied\n' >"$T/err_r_i_den"
chk "two-platform index" "$("$HERE/index-platforms.sh" r/i:idx)" "index linux/amd64 linux/arm64"
chk "amd64 index with attestation" "$("$HERE/index-platforms.sh" r/i:amd)" "index linux/amd64"
chk "single manifest" "$("$HERE/index-platforms.sh" r/i:one)" "single"
for pair in "nosuch 3" "bad 1" "den 1"; do set -- $pair
  rc=0; "$HERE/index-platforms.sh" r/i:$1 >/dev/null 2>&1 || rc=$?; chk "$1 -> rc $2" "$rc" "$2"; done

# ---- assemble-multiarch-index.sh (arm64 attach rules)
export STUB_LOG=$T/log ARCHES=$T/arches
R=reg/x
printf '%s\n' "$R@$A=amd64" "$R@$B=arm64" >"$ARCHES"
run() { : >"$STUB_LOG"; "$HERE/assemble-multiarch-index.sh" "$@" >/dev/null 2>&1; echo $?; }
chk "both ok -> rc 0" "$(run --amd64 $A --arm64 $B --arm64-outcome success --repo $R --tag t1 --tag t2)" 0
chk "both ok -> 1 create with 2 sources, 2 tags" "$(grep -c "create create -t $R:t1 -t $R:t2 $R@$A $R@$B\$" "$STUB_LOG")" 1
chk "arm64 failed (digest present, stale) -> amd64 only" "$(run --amd64 $A --arm64 $B --arm64-outcome failure --repo $R --tag t1)" 0
chk "  ... create has no arm64 digest" "$(grep -c "$B" "$STUB_LOG" || true)" 0
run --amd64 $A --repo $R --tag t1 >/dev/null
chk "arm64 skipped -> amd64 only" "$(grep -c "$B" "$STUB_LOG" || true)" "0"
chk "malformed amd64 digest -> refuse" "$(run --amd64 nope --repo $R --tag t1)" 1
chk "  ... nothing created" "$(grep -c create "$STUB_LOG" || true)" 0
printf '%s\n' "$R@$A=arm64" >"$ARCHES"
chk "amd64 digest that is not amd64 -> refuse" "$(run --amd64 $A --repo $R --tag t1)" 1
[ "$fail" -eq 0 ] && echo "ALL PASS" || { echo FAILURES; exit 1; }