#!/usr/bin/env bash
## image-label-amd64.test.sh — fixtures for scripts/image-label-amd64.sh and
## scripts/php-emergency-guard.sh, driven through a stub IMAGETOOLS.
## Proves: index-safe (two-platform OCI index WITH attestation children, Docker
## manifest list, single-platform manifest), fail-closed on malformed/ambiguous
## input, "not found" = proceed, and that for single-platform images the guard
## makes the SAME decision as the old inline step on every (src,cur,new) case.
set -euo pipefail
HERE=$(cd "$(dirname "$0")/.." && pwd)
T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
mkdir -p "$T/raw" "$T/cfg" "$T/err"
fail=0
chk() { if [ "$2" = "$3" ]; then echo "ok   $1"; else echo "FAIL $1: got '$2' want '$3'"; fail=1; fi; }

# ---- stub: inspect --raw REF / inspect REF --format ... ; fixtures keyed by ref
key() { printf '%s' "$1" | tr '/:@' '___'; }
cat >"$T/it" <<'STUB'
#!/usr/bin/env bash
# args: inspect --raw REF | inspect REF --format F
d=$FIXDIR
[ "$1" = inspect ] || exit 2
if [ "$2" = --raw ]; then ref=$3; kind=raw; else ref=$2; kind=cfg; fi
k=$(printf '%s' "$ref" | tr '/:@' '___')
if [ -f "$d/err/$k" ]; then cat "$d/err/$k" >&2; exit 1; fi
[ -f "$d/$kind/$k" ] || { echo "ERROR: $ref: not found" >&2; exit 1; }
cat "$d/$kind/$k"
STUB
chmod +x "$T/it"
export FIXDIR=$T IMAGETOOLS="$T/it"

A=sha256:$(printf 'a%.0s' {1..64}); B=sha256:$(printf 'b%.0s' {1..64})
C=sha256:$(printf 'c%.0s' {1..64}); D=sha256:$(printf 'd%.0s' {1..64})
REPO=reg.example/org/img
put() { printf '%s' "$3" >"$T/$1/$(key "$2")"; }
cfg() { # arch src php  -> image config json
  printf '{"architecture":"%s","os":"linux","config":{"Labels":{"org.whp.lsphp-source":"%s","org.whp.php-version":"%s"}}}' "$1" "$2" "$3"; }

# 1. OCI index: amd64 + arm64 + two attestation children (unknown/unknown)
put raw $REPO:php85 '{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[
 {"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"'$A'","platform":{"architecture":"amd64","os":"linux"}},
 {"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"'$C'","platform":{"architecture":"unknown","os":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest","vnd.docker.reference.digest":"'$A'"}},
 {"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"'$B'","platform":{"architecture":"arm64","os":"linux"}},
 {"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"'$D'","platform":{"architecture":"unknown","os":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest","vnd.docker.reference.digest":"'$B'"}}]}'
put cfg $REPO@$A "$(cfg amd64 php.net 8.5.12)"
put cfg $REPO@$B "$(cfg arm64 php.net 8.5.99)"   # must never be read
printf '%s\n%s\n' php.net 8.5.12 >"$T/want"
chk "index+attestations: amd64 labels" "$("$HERE/image-label-amd64.sh" $REPO:php85 org.whp.lsphp-source org.whp.php-version)" "$(cat "$T/want")"

# 2. Docker manifest list (no attestations)
put raw $REPO:ml '{"schemaVersion":2,"mediaType":"application/vnd.docker.distribution.manifest.list.v2+json","manifests":[
 {"mediaType":"application/vnd.docker.distribution.manifest.v2+json","digest":"'$B'","platform":{"architecture":"arm64","os":"linux","variant":"v8"}},
 {"mediaType":"application/vnd.docker.distribution.manifest.v2+json","digest":"'$A'","platform":{"architecture":"amd64","os":"linux"}}]}'
chk "docker manifest list" "$("$HERE/image-label-amd64.sh" $REPO:ml org.whp.php-version)" "8.5.12"

# 3. Single-platform manifest (today's amd64-only images); ref with digest too
put raw $REPO:single '{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"digest":"'$A'"},"layers":[]}'
put cfg $REPO:single "$(cfg amd64 litespeed 8.5.1)"
chk "single-platform manifest" "$("$HERE/image-label-amd64.sh" $REPO:single org.whp.lsphp-source org.whp.php-version | tr '\n' ,)" "litespeed,8.5.1,"
chk "absent label prints empty" "$("$HERE/image-label-amd64.sh" $REPO:single org.whp.nope)" ""
put raw $REPO:nolabels '{"mediaType":"x","config":{},"layers":[]}'
put cfg $REPO:nolabels '{"architecture":"amd64","config":{}}'
chk "config without Labels" "$("$HERE/image-label-amd64.sh" $REPO:nolabels org.whp.php-version)" ""

# 4. failures: each must exit non-zero (1) with nothing on stdout
bad() { # name ref
  local out rc=0; out=$("$HERE/image-label-amd64.sh" "$2" org.whp.php-version 2>/dev/null) || rc=$?
  chk "$1 -> rc $3" "$rc" "$3"; chk "$1 -> no stdout" "$out" ""
}
bad "tag not found" $REPO:nosuch 3
put raw $REPO:garbage 'this is not json'; bad "malformed JSON" $REPO:garbage 1
put raw $REPO:arr '[1,2]'; bad "JSON not an object" $REPO:arr 1
put raw $REPO:unk '{"foo":"bar"}'; bad "neither index nor manifest" $REPO:unk 1
put raw $REPO:armonly '{"manifests":[{"digest":"'$B'","platform":{"architecture":"arm64","os":"linux"}}]}'; bad "index without amd64" $REPO:armonly 1
put raw $REPO:two '{"manifests":[{"digest":"'$A'","platform":{"architecture":"amd64","os":"linux"}},{"digest":"'$D'","platform":{"architecture":"amd64","os":"linux"}}]}'; bad "ambiguous amd64" $REPO:two 1
put raw $REPO:baddig '{"manifests":[{"digest":"sha256:short","platform":{"architecture":"amd64","os":"linux"}}]}'; bad "malformed child digest" $REPO:baddig 1
put raw $REPO:badcfg '{"manifests":[{"digest":"'$D'","platform":{"architecture":"amd64","os":"linux"}}]}'
put cfg $REPO@$D 'not json'; bad "malformed config" $REPO:badcfg 1
put raw $REPO:wrongarch '{"manifests":[{"digest":"'$C'","platform":{"architecture":"amd64","os":"linux"}}]}'
put cfg $REPO@$C "$(cfg arm64 php.net 8.5.12)"; bad "amd64 slot with arm64 config" $REPO:wrongarch 1
printf 'ERROR: denied: requested access to the resource is denied\n' >"$T/err/$(key $REPO:denied)"; bad "auth/network error is NOT 'not found'" $REPO:denied 1
put raw $REPO:orphan '{"manifests":[{"digest":"'$B'","platform":{"architecture":"amd64","os":"linux"}}]}'; bad "child listed but missing" $REPO:orphan 1

# 5. Guard == old inline logic on single-platform fixtures, all combos
old() { # src cur new -> proceed|refuse  (verbatim predicate of the old step)
  local src=$1 cur=$2 new=$3
  if [ "$src" = "php.net" ] && [ "$cur" != "$new" ] && [ "$(printf '%s\n%s\n' "$cur" "$new" | sort -V | tail -n1)" = "$cur" ]; then echo refuse; else echo proceed; fi; }
n=0
for src in php.net litespeed ""; do for cur in "" 8.5.11 8.5.12 8.5.13 8.4.99 8.10.0; do for new in 8.5.12 8.5.9 8.6.0; do
  put raw $REPO:g '{"mediaType":"x","config":{},"layers":[]}'
  put cfg $REPO:g "$(cfg amd64 "$src" "$cur")"
  rc=0; "$HERE/php-emergency-guard.sh" $REPO:g "$new" >/dev/null 2>&1 || rc=$?
  got=proceed; [ "$rc" -ne 0 ] && got=refuse
  w=$(old "$src" "$cur" "$new"); n=$((n+1))
  [ "$got" = "$w" ] || { echo "FAIL guard vs old: src='$src' cur='$cur' new='$new' got=$got old=$w"; fail=1; }
done; done; done
echo "ok   guard == old inline logic on $n single-platform combos"

# 6. Guard on a multi-arch index: refuses the rollback (old logic could not even read it)
rc=0; "$HERE/php-emergency-guard.sh" $REPO:php85 8.5.9 >/dev/null 2>&1 || rc=$?; chk "index: emergency 8.5.12 vs packaged 8.5.9 refused" "$rc" 1
rc=0; "$HERE/php-emergency-guard.sh" $REPO:php85 8.6.0 >/dev/null 2>&1 || rc=$?; chk "index: packaged newer proceeds" "$rc" 0
# 7. fail closed vs first build
rc=0; "$HERE/php-emergency-guard.sh" $REPO:nosuch 8.5.9 >/dev/null 2>&1 || rc=$?; chk "tag absent: proceed (first build)" "$rc" 0
for t in garbage denied armonly orphan wrongarch; do
  rc=0; "$HERE/php-emergency-guard.sh" $REPO:$t 8.5.9 >/dev/null 2>&1 || rc=$?; chk "unreadable ($t): FAIL CLOSED" "$rc" 1
done
[ "$fail" -eq 0 ] && echo "ALL PASS" || { echo "FAILURES"; exit 1; }