#!/usr/bin/env bash
#
# Tests for publish.sh -- the one script in this repo that needs real
# network to do its actual job (fdroid-repo-ci#1), so its happy path against
# a genuine bucket is out of scope here. What this asserts instead:
#
# * argument/credential validation, offline;
# * `--dry-run` builds the exact command a real run would use, offline;
# * a real invocation against a closed local port fails on the network call
#   itself, not on argument parsing -- proving the command it built is
#   well-formed, without needing a real bucket or reaching beyond loopback.
set -euo pipefail
here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
source "$here/test_lib.sh"

work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT
mkdir -p "$work/repo"
echo '{}' > "$work/repo/index-v2.json"

echo "--- missing credentials are refused, not sent as empty ---"
assert_failure "publish.sh refuses with no AWS_ACCESS_KEY_ID" \
  env -u AWS_ACCESS_KEY_ID -u AWS_SECRET_ACCESS_KEY \
  bash "$here/publish.sh" "$work/repo" mybucket https://s3.example.invalid

export AWS_ACCESS_KEY_ID=AKIAFAKETESTKEY
export AWS_SECRET_ACCESS_KEY=fake-secret-not-real

echo "--- missing local directory is refused ---"
assert_failure "publish.sh refuses a non-existent local directory" \
  bash "$here/publish.sh" "$work/does-not-exist" mybucket https://s3.example.invalid

echo "--- --dry-run builds the right command, touches no network ---"
out=$(bash "$here/publish.sh" --dry-run "$work/repo" mybucket https://s3.example.invalid myprefix)
assert_contains "dry-run names the destination bucket and prefix" "$out" "s3://mybucket/myprefix"
assert_contains "dry-run names the endpoint" "$out" "--endpoint-url https://s3.example.invalid"
assert_contains "dry-run goes through with-nixpkgs.sh, same as every other script" "$out" "with-nixpkgs.sh"
if echo "$out" | grep -q -- --delete; then
  fail "dry-run does not silently add --delete (it did!)"
else
  pass "dry-run does not silently add --delete"
fi

echo "--- --dry-run with no prefix omits the trailing slash entirely ---"
out_noprefix=$(bash "$here/publish.sh" --dry-run "$work/repo" mybucket https://s3.example.invalid)
assert_contains "no-prefix dry-run targets the bucket root" "$out_noprefix" "s3://mybucket "

echo "--- a real invocation fails on the network call, not on arguments ---"
# port 1 is a reserved, unassigned TCP port -- nothing listens there, so this
# never leaves the loopback interface and needs no real network access.
real_out=$(bash "$here/publish.sh" "$work/repo" mybucket "http://127.0.0.1:1" 2>&1) && rc=0 || rc=$?
if [ "${rc:-0}" -ne 0 ]; then pass "publish.sh against a closed port exits non-zero"; else
  fail "publish.sh against a closed port exits non-zero (got 0)"
fi
assert_contains "the failure is a connection error, not an argument error" "$real_out" "Could not connect"

report_and_exit