#!/bin/bash
# simplegit HTTP push/clone e2e (self-contained, skip-auth).
#
# Verifies the smart-HTTP transport now carries git-receive-pack (push) as well
# as git-upload-pack (clone/fetch). Runs simplegit in -skip-auth mode against a
# throwaway root so no console / RBAC center is needed; this exercises the
# http-backend + http.receivepack wiring (the env-inject path in
# serveGitHTTPBackend) end to end.
#
# The auth-gated paths (401 on anonymous push, 403 on denied push, Bearer vs
# Basic) need a running console -- see "Manual auth checks" at the bottom.
#
# Run:   ./tests/http_push.sh
#        BIN=./build/simplegit RPC_PORT=18093 ./tests/http_push.sh
set -u

BIN="${BIN:-./build/simplegit}"
RPC_PORT="${RPC_PORT:-18093}"
RPC="127.0.1.1:$RPC_PORT"
BASE_URL="http://$RPC"

if [ ! -x "$BIN" ]; then
	echo "FAIL: simplegit binary not found at $BIN (run 'make build' first)"
	exit 1
fi

WORK="$(mktemp -d)"
ROOT="$WORK/repos"
SG_PID=""
trap 'rm -rf "$WORK"; [ -n "$SG_PID" ] && kill "$SG_PID" 2>/dev/null' EXIT

mkdir -p "$ROOT"

# --- start simplegit (skip-auth: anon read+write, no console needed) ---
"$BIN" -rpc "$RPC" -ssh "" -root "$ROOT" -skip-auth >"$WORK/sg.log" 2>&1 &
SG_PID=$!

# wait until the HTTP port answers
up=0
for _ in $(seq 1 50); do
	if curl -s -o /dev/null "$BASE_URL/" 2>/dev/null; then up=1; break; fi
	sleep 0.1
done
[ "$up" = 1 ] || { echo "FAIL: simplegit did not come up on $RPC"; cat "$WORK/sg.log"; exit 1; }

pass=0; fail=0
check() {
	if [ "$2" = "$3" ]; then echo "  PASS: $1"; pass=$((pass+1))
	else echo "  FAIL: $1 (expected [$2], got [$3])"; fail=$((fail+1)); fi
}

echo "## setup: bare repo on disk (owner/name.git)"
mkdir -p "$ROOT/alice"
git init --bare -q "$ROOT/alice/repo.git"
git -C "$ROOT/alice/repo.git" symbolic-ref HEAD refs/heads/main

echo "## HTTP clone (empty repo)"
CLONE="$WORK/clone"
git clone -q "$BASE_URL/alice/repo.git" "$CLONE" 2>/dev/null
[ -d "$CLONE/.git" ] && check "clone empty repo" "ok" "ok" || check "clone empty repo" "ok" "fail"

echo "## HTTP push (receive-pack over smart-HTTP)"
( cd "$CLONE"
  git config user.email t@t; git config user.name t
  echo hello > a; git add .; git commit -qm "init"
  git push -q "$BASE_URL/alice/repo.git" HEAD:main
) 2>/dev/null
SERVER_SHA=$(git -C "$ROOT/alice/repo.git" rev-parse main 2>/dev/null || echo "")
LOCAL_SHA=$(git -C "$CLONE" rev-parse HEAD 2>/dev/null || echo "")
[ -n "$SERVER_SHA" ] && [ "$SERVER_SHA" = "$LOCAL_SHA" ] \
	&& check "push landed on server" "ok" "ok" \
	|| check "push landed on server" "ok" "fail (server=$SERVER_SHA local=$LOCAL_SHA)"

echo "## HTTP clone (non-empty)"
CLONE2="$WORK/clone2"
git clone -q "$BASE_URL/alice/repo.git" "$CLONE2" 2>/dev/null
[ -f "$CLONE2/a" ] && check "clone sees pushed file" "ok" "ok" || check "clone sees pushed file" "ok" "fail"

echo
echo "## $pass passed, $fail failed"
[ "$fail" -eq 0 ] || { echo "--- server log ---"; cat "$WORK/sg.log"; exit 1; }

# ---------------------------------------------------------------------------
# Manual auth checks (need console running; simplegit started with -auth):
#
#   TOKEN=<jwt from console Login>   REPO=alice/repo.git   RPC=http://127.0.1.1:8093
#
#   # 1. Bearer push succeeds:
#   git -c http.extraHeader="Authorization: Bearer $TOKEN" push "$RPC/$REPO" HEAD
#
#   # 2. Basic-auth push (password carries the JWT) succeeds:
#   git push "http://alice:$TOKEN@${RPC#http://}/$REPO" HEAD
#
#   # 3. Anonymous push -> 401 (git prints "Authentication failed"):
#   git push "$RPC/$REPO" HEAD
#
#   # 4. Anonymous clone of a public repo succeeds:
#   git clone "$RPC/$REPO"