#!/usr/bin/env bash
## lsphp-info-probe.test.sh — regression test for the SIGPIPE-under-pipefail
## class of bug that shipped in cac-lsphp (trunk 9343a56) and silently turned
## $_SERVER path parity off on every shared-ols site whose host lost the race.
##
## THE BUG. entrypoint-lsphp.sh asked "is cac_path_parity loaded?" with
##
##     printf '%s\n' "$LSPHP_INFO" | grep -q '^cac_path_parity support => enabled$'
##
## under `set -euo pipefail`. `grep -q` exits the instant it matches; printf is
## still pushing the remaining ~40 KB of `lsphp -i` into the pipe, takes
## SIGPIPE, and exits 141; pipefail prefers that over grep's 0. So the test read
## FALSE **because the extension was present** — present early enough in the
## output to stop the reader — and the container fell back to the degraded
## auto_prepend normaliser the extension exists to replace, while telling the
## operator the extension was "not loadable in this image".
##
## WHY THE EXISTING SUITE DID NOT CATCH IT. The .phpt suite and
## fpm-parity-check.sh both test the EXTENSION; nothing executed the
## ENTRYPOINT's branch logic, and the Dockerfile's own `lsphp -i | grep -q`
## build gate runs under `bash -c 'set -e'` with NO pipefail, so it reported the
## extension present in the very image whose entrypoint declared it missing.
##
## WHAT THIS ASSERTS.
##   1. behaviour — the SHIPPED probe helpers (extracted verbatim from
##      entrypoint-lsphp.sh, never copied, so they cannot drift) return the
##      right answer AND a clean exit status under `set -euo pipefail` with a
##      realistic ~40 KB phpinfo body.
##   2. structure — no script in this repo that enables pipefail pipes into a
##      reader that can exit before its writer finishes. This is the check that
##      fails deterministically against trunk; assertion 1's *old* form is a
##      RACE (measured 141 on 3 of 5 runs here, 5 of 5 on whp02, and 0 of 5
##      under a different Docker daemon), so no behavioural assertion about the
##      broken code could be trusted to fail on every machine. Section 4 runs
##      the old form anyway and prints what it did, for the record.
##
## SCOPE LIMITS, stated rather than hidden. The structural scan is a text scan,
## so it under-reports in two known ways:
##   - it reads one line at a time. The repo's only multi-line pipeline
##     (ols-htaccess-watcher.sh's `inotifywait … |` / `while read`) is invisible
##     to it and was reviewed by hand: that reader loops until EOF, i.e. until
##     the writer has already gone, so it cannot produce this failure.
##   - its quote stripping is flat, so a pipe nested inside a command
##     substitution inside a quoted string (`echo "x ($(a | head -1))"`) is read
##     as quoted text and skipped.
## It is a guard against reintroducing the shape, not a proof of its absence.
##
## Usage: scripts/tests/lsphp-info-probe.test.sh [REPO_ROOT]
## Exit: 0 all assertions passed, 1 an assertion FAILED, 2 the test could not run.

set -uo pipefail

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT="${1:-$(cd "$HERE/../.." && pwd)}"
ENTRYPOINT="$ROOT/scripts/entrypoint-lsphp.sh"
TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT

pass=0; fail=0
ok()   { pass=$((pass+1)); echo "  ok   — $1"; }
bad()  { fail=$((fail+1)); echo "  FAIL — $1" >&2; }
die()  { echo "HARNESS FAILURE: $*" >&2; exit 2; }

[ -f "$ENTRYPOINT" ] || die "no entrypoint at $ENTRYPOINT (pass REPO_ROOT as \$1)"

## ---------------------------------------------------------------------------
## 1. Extract the real probe helpers. Not a copy: whatever the shipped
##    entrypoint says between the markers is what runs below, so a future edit
##    that reintroduces a pipeline is tested, not narrated.
##
##    A missing block is an assertion FAILURE, not a harness error, and it does
##    not stop the run: against a pre-fix checkout the probes are still inline
##    pipelines, and section 5 below is what names them. Bailing out here would
##    have replaced that report with "could not run".
## ---------------------------------------------------------------------------
HAVE_HELPERS=yes
awk '/^## ---- CAC-TEST: probe helpers BEGIN ----$/{f=1} f{print} /^## ---- CAC-TEST: probe helpers END ----$/{exit}' \
    "$ENTRYPOINT" > "$TMP/helpers.sh"
if [ -s "$TMP/helpers.sh" ]; then
  for fn in lsphp_info_has_parity_ext lsphp_info_scan_dir lsphp_info_is_usable; do
    if ! grep -q "^${fn}()" "$TMP/helpers.sh"; then
      HAVE_HELPERS=no
      bad "the probe-helper block in ${ENTRYPOINT#"$ROOT"/} defines no ${fn}()"
    fi
  done
else
  HAVE_HELPERS=no
  bad "no probe-helper markers in ${ENTRYPOINT#"$ROOT"/} — either they were removed, or this is a pre-fix checkout where the probes are still inline pipelines (trunk 9343a56). Section 5 says which lines."
fi

## ---------------------------------------------------------------------------
## 2. Fixtures. Shaped like real `lsphp -i`: the two lines the probes look for
##    sit near the TOP (that is what lets a reader stop early), with tens of KB
##    of body after them. A fixture whose marker is near the end could not
##    SIGPIPE at all and would make this whole test vacuous, so both properties
##    are asserted before anything else runs.
## ---------------------------------------------------------------------------
SCAN_PATH='/usr/local/lsws/lsphp83/etc/php/8.3/mods-available'
make_fixture() {  # $1=outfile  $2=yes|no (include the cac_path_parity line)
  {
    printf 'phpinfo()\nPHP Version => 8.3.27\n\n'
    printf 'System => Linux 6ecb4e0a1c1f 5.15.0 #1 SMP x86_64\n'
    printf 'Server API => LiteSpeed V8.3\n'
    printf 'Configuration File (php.ini) Path => /usr/local/lsws/lsphp83/etc/php/8.3/litespeed\n'
    printf 'Scan this dir for additional .ini files => %s\n' "$SCAN_PATH"
    printf 'PHP API => 20230831\nDebug Build => no\nThread Safety => disabled\n\n'
    printf 'bcmath\n\nBCMath support => enabled\n\n'
    printf 'calendar\n\nCalendar support => enabled\n\n'
    [ "$2" = yes ] && printf 'cac_path_parity\n\ncac_path_parity support => enabled\nRewriting => active\n\n'
    printf 'Core\n\nPHP Version => 8.3.27\n\n'
    ## ~40 KB of directive rows, exactly the shape phpinfo() prints them in.
    local i=0
    while [ "$i" -lt 700 ]; do
      printf 'some.directive_%03d => local_value_%03d => master_value_%03d\n' "$i" "$i" "$i"
      i=$((i+1))
    done
  } > "$1"
}
make_fixture "$TMP/info-present.txt" yes
make_fixture "$TMP/info-absent.txt"  no
: > "$TMP/info-empty.txt"

echo "== fixture sanity =="
FIX_BYTES=$(wc -c < "$TMP/info-present.txt")
MATCH_OFF=$(grep -b -m1 '^cac_path_parity support => enabled$' "$TMP/info-present.txt" | cut -d: -f1)
if [ "$FIX_BYTES" -ge 32768 ]; then
  ok "fixture is ${FIX_BYTES} bytes (realistic 'lsphp -i' is ~40 KB)"
else
  bad "fixture is only ${FIX_BYTES} bytes — too small to reproduce the failure"
fi
if [ "$MATCH_OFF" -lt $((FIX_BYTES / 4)) ]; then
  ok "match sits at byte ${MATCH_OFF} of ${FIX_BYTES} — most of the body is still unwritten when a reader could stop"
else
  bad "match at byte ${MATCH_OFF} of ${FIX_BYTES} leaves too small a tail; the test would be vacuous"
fi

## ---------------------------------------------------------------------------
## 3. Behaviour, under the REAL option set (`set -euo pipefail`, as line 34 of
##    the entrypoint sets it). Each case runs in its own bash process so the
##    options and the exit status are the genuine article, not something this
##    harness simulated.
## ---------------------------------------------------------------------------
cat > "$TMP/runner.sh" <<'RUNNER'
#!/usr/bin/env bash
set -euo pipefail
# shellcheck disable=SC1091
source "$1"                      # the extracted probe helpers
LSPHP_INFO=$(cat "$2")
case "$3" in
  has_ext)  lsphp_info_has_parity_ext "$LSPHP_INFO" ;;
  scan_dir) lsphp_info_scan_dir "$LSPHP_INFO" ;;
  usable)   lsphp_info_is_usable "$LSPHP_INFO" ;;
  legacy)   printf '%s\n' "$LSPHP_INFO" | grep -q '^cac_path_parity support => enabled$' ;;
  *) echo "unknown case $3" >&2; exit 99 ;;
esac
RUNNER

## NOT `out=$(run …)`: command substitution runs the function in a subshell,
## where an exit status assigned to RC would be thrown away with it. Run in this
## shell, capture stdout through a file, and RC is the real thing.
RC=0; out=""
run() {  # $1=fixture $2=case -> sets RC and out
  RC=0
  bash "$TMP/runner.sh" "$TMP/helpers.sh" "$1" "$2" >"$TMP/out" 2>&1 || RC=$?
  out=$(cat "$TMP/out")
}

echo "== the shipped probes under set -euo pipefail =="
if [ "$HAVE_HELPERS" = no ]; then
  echo "  (skipped — no probe helpers to run; see the failure above)"
fi
if [ "$HAVE_HELPERS" = yes ]; then

run "$TMP/info-present.txt" has_ext
if [ "$RC" -eq 0 ]; then
  ok "extension present => branch TAKEN (exit 0)"
elif [ "$RC" -eq 141 ]; then
  bad "exit 141 (SIGPIPE): the probe is a pipeline again — this is the original bug"
else
  bad "extension present => exit $RC (expected 0). Output: $out"
fi

run "$TMP/info-absent.txt" has_ext
if [ "$RC" -eq 1 ]; then
  ok "extension genuinely absent => branch NOT taken (exit 1, a clean 'no')"
else
  bad "extension absent => exit $RC (expected 1). Output: $out"
fi

run "$TMP/info-present.txt" scan_dir
if [ "$RC" -eq 0 ] && [ "$out" = "$SCAN_PATH" ]; then
  ok "scan-dir probe returns '$out' (exit 0)"
elif [ "$RC" -eq 141 ]; then
  bad "scan-dir probe exit 141 (SIGPIPE) — as a bare assignment under set -e that KILLS PID 1"
else
  bad "scan-dir probe => exit $RC, got '$out', expected '$SCAN_PATH'"
fi

run "$TMP/info-present.txt" usable
if [ "$RC" -eq 0 ]; then ok "usability probe: real phpinfo body => usable (exit 0)"
else bad "usability probe on real body => exit $RC (expected 0)"; fi

run "$TMP/info-empty.txt" usable
if [ "$RC" -eq 1 ]; then ok "usability probe: empty body => NOT usable (exit 1)"
else bad "usability probe on empty body => exit $RC (expected 1)"; fi

## The two failure causes must be reported as the different things they are.
## A probe that cannot answer has established nothing about the image, and the
## old message asserted the opposite of that for every reason it fired.
## SC2016: these patterns are the entrypoint's literal text, `$` and all.
# shellcheck disable=SC2016
if grep -q 'if lsphp_info_is_usable "$LSPHP_INFO"; then' "$ENTRYPOINT" &&
   grep -q 'This is a PROBE failure and establishes nothing' "$ENTRYPOINT"; then
  ok "a probe that produced nothing is reported as OUR failure, not as a verdict on the image"
else
  bad "entrypoint no longer reports an unusable 'lsphp -i' as a probe failure"
fi
# shellcheck disable=SC2016
if grep -q 'not loadable in this image' "$ENTRYPOINT" &&
   grep -q 'answered (${#LSPHP_INFO} bytes, scan dir ${SCAN_DIR}) and does not list it' "$ENTRYPOINT"; then
  ok "the 'extension not loadable' verdict now ships the evidence it rests on"
else
  bad "the 'extension not loadable' message no longer states what it observed"
fi

fi   # HAVE_HELPERS

## ---------------------------------------------------------------------------
## 4. The old form, for the record. NOT asserted: it is a race, and asserting a
##    race would make this suite flap on whichever machine happens to win it.
## ---------------------------------------------------------------------------
echo "== the pre-fix pipeline form on the same input (informational) =="
if [ "$HAVE_HELPERS" = no ]; then
  echo "  (skipped — the runner needs the helper block to source)"
fi
legacy_rcs=""
if [ "$HAVE_HELPERS" = yes ]; then
for _ in 1 2 3 4 5 6 7 8 9 10; do
  run "$TMP/info-present.txt" legacy
  legacy_rcs="$legacy_rcs $RC"
done
echo "  10 runs of 'printf | grep -q' under pipefail:${legacy_rcs}"
echo "  (0 = happened to finish writing, 141 = writer SIGPIPEd and pipefail reported the"
echo "   extension MISSING because it was present. Either value is expected here.)"
fi

## ---------------------------------------------------------------------------
## 5. Structural scan — the deterministic guard, and the part of this file that
##    fails against trunk on EVERY machine. Any script that turns on pipefail
##    and pipes into a reader that can stop early has this bug latent in it
##    whether or not today's buffer sizes expose it, so the shape is what gets
##    outlawed, not the symptom.
##
##    It is a text scan, so it is honest about its limits: it strips quoted
##    spans and comments (that is what keeps `case a|b)`, `sed "s|x|y|"` and
##    `echo "a | b"` from being reported), it requires the reader to be the
##    FIRST word after a pipe, and it reads one line at a time. This file is
##    skipped because section 4 runs the broken form on purpose.
## ---------------------------------------------------------------------------
echo "== structural scan: early-exit readers in pipefail scripts =="
mapfile -t PIPEFAIL_FILES < <(grep -rl --include='*.sh' -E '^[[:space:]]*set[[:space:]]+-[a-zA-Z]*[[:space:]]*o?[[:space:]]*pipefail|^[[:space:]]*set[[:space:]]+-o[[:space:]]+pipefail' "$ROOT/scripts" "$ROOT/ext" 2>/dev/null | sort)
[ "${#PIPEFAIL_FILES[@]}" -gt 0 ] || die "found no pipefail-enabled scripts under $ROOT — the scan would be vacuous"

cat > "$TMP/scan.awk" <<'AWKPROG'
{
  raw = $0
  l = raw
  gsub(/\\"/, "X", l); gsub(/\\'/, "X", l)          # escaped quotes are not delimiters
  while (match(l, /'[^']*'/)) l = substr(l, 1, RSTART-1) "SQ" substr(l, RSTART+RLENGTH)
  while (match(l, /"[^"]*"/))             l = substr(l, 1, RSTART-1) "DQ" substr(l, RSTART+RLENGTH)
  if (l ~ /^[[:space:]]*#/) next                        # whole-line comment
  sub(/[[:space:]]#.*/, "", l)                          # trailing comment
  gsub(/\|\|/, " ", l)                                  # || is not a pipeline
  if (l !~ /\|/) next
  n = split(l, seg, "|")
  for (i = 2; i <= n; i++) {
    r = seg[i]
    if (r ~ /^[[:space:]]*grep[[:space:]]+-([[:alnum:]]*q|m)/)      { print NR ": " raw; next }
    if (r ~ /^[[:space:]]*head([[:space:]]|$)/)                     { print NR ": " raw; next }
    if (r ~ /^[[:space:]]*(while[[:space:]]+)?read([[:space:]]|$)/) { print NR ": " raw; next }
    if (r ~ /^[[:space:]]*awk([[:space:]]|$)/ && raw ~ /exit/)      { print NR ": " raw; next }
    if (r ~ /^[[:space:]]*sed([[:space:]]|$)/ && raw ~ /[;{\/][[:space:]]*[qQ][^[:alnum:]]/) { print NR ": " raw; next }
  }
}
AWKPROG

offenders=0
for f in "${PIPEFAIL_FILES[@]}"; do
  [ "$(basename "$f")" = "$(basename "${BASH_SOURCE[0]}")" ] && continue
  while IFS= read -r hit; do
    offenders=$((offenders+1))
    echo "  FAIL — ${f#"$ROOT"/}:${hit}" >&2
  done < <(awk -f "$TMP/scan.awk" "$f")
done
if [ "$offenders" -eq 0 ]; then
  ok "${#PIPEFAIL_FILES[@]} pipefail-enabled scripts, no pipeline whose reader can outrun its writer"
else
  bad "$offenders pipeline(s) above pipe into an early-exit reader under pipefail."
  echo "       Read the value into a variable and match it with a here-string (see" >&2
  echo "       lsphp_info_has_parity_ext in scripts/entrypoint-lsphp.sh), or give the" >&2
  echo "       reader the file directly. A here-string is not a pipeline, so there is" >&2
  echo "       no second exit status for pipefail to prefer." >&2
fi

echo
echo "passed: $pass   failed: $fail"
[ "$fail" -eq 0 ] || exit 1
exit 0