#!/usr/bin/env bash
# End-to-end test through the real path: real overlayfs, namespaces, slirp4netns, filesystem.
# Usage: tests/run.sh [path/to/doos]
set -u
DOOS=$(readlink -f "${1:-$(dirname "$0")/../build/doos}")
export DOOS_HOME=$(mktemp -d)
pass=0; fail=0
ok()   { pass=$((pass+1)); echo "ok   $1"; }
bad()  { fail=$((fail+1)); echo "FAIL $1"; }
check() { local d=$1; shift; if "$@" >/dev/null 2>&1; then ok "$d"; else bad "$d"; fi; }
out()  { "$DOOS" attach t -- sh -c "$1" 2>&1; }
trap '"$DOOS" delete --yes t >/dev/null 2>&1; rm -rf "$DOOS_HOME"' EXIT

check "list empty"                  "$DOOS" list
check "get_or_create creates"       "$DOOS" get_or_create t
[ "$("$DOOS" get_or_create t)" = "exists t" ] && ok "get_or_create idempotent" || bad "get_or_create idempotent"
check "invalid name rejected"       bash -c "! '$DOOS' get_or_create 'Bad Name'"
check "net mode fixed at creation"  bash -c "! '$DOOS' get_or_create --net none t"

[ "$(out 'id -u')" = "0" ] && ok "root inside" || bad "root inside"
[ "$(out hostname)" = "t" ] && ok "own hostname" || bad "own hostname"
[ "$(out 'echo $$')" != "" ] && ok "attach runs command" || bad "attach runs command"
[ "$(out 'cat /proc/1/comm; ps -e 2>/dev/null | wc -l' | head -1)" != "" ] && ok "own pid ns" || bad "own pid ns"
[ "$(out 'ls /home 2>&1; echo $?' | tail -1)" != "0" ] && ok "host /home hidden" || bad "host /home hidden"
[ "$(out 'test -e /sys && echo yes || echo no')" = "no" ] && ok "no /sys" || bad "no /sys"

out 'echo x > /usr/doos-test-file && echo x > /etc/doos-test-file && echo x > /root/persist' >/dev/null
[ ! -e /usr/doos-test-file ] && [ ! -e /etc/doos-test-file ] && ok "host /usr,/etc untouched" || bad "host /usr,/etc untouched"
[ "$(out 'cat /usr/doos-test-file /root/persist | tr -d "\n"')" = "xx" ] && ok "writes persist across attach" || bad "writes persist across attach"
[ "$(out 'echo 1 > /proc/sys/kernel/hostname 2>&1; echo $?' | tail -1)" != "0" ] && ok "/proc/sys read-only" || bad "/proc/sys read-only"

# network: slirp
out 'getent hosts example.com' | grep -q . && ok "slirp: dns" || bad "slirp: dns"
out 'bash -c "exec 3<>/dev/tcp/1.1.1.1/443 && echo up"' | grep -q up && ok "slirp: outbound tcp" || bad "slirp: outbound tcp"
python3 -m http.server 0 --bind 127.0.0.1 >/tmp/doos-hs.$$ 2>&1 & hs=$!; sleep 1
port=$(grep -o 'port [0-9]*' /tmp/doos-hs.$$ | grep -o '[0-9]*')
[ -n "$port" ] && out "bash -c \"exec 3<>/dev/tcp/127.0.0.1/$port && echo reach\"" | grep -q reach && bad "host loopback isolated" || ok "host loopback isolated"
kill $hs 2>/dev/null; rm -f /tmp/doos-hs.$$

# concurrent attach joins the running container
"$DOOS" attach t -- sh -c 'sleep 4' & sleep 1
[ "$("$DOOS" list | awk '$1=="t"{print $2}')" = "running" ] && ok "list shows running" || bad "list shows running"
check "delete refuses running"      bash -c "! '$DOOS' delete --yes t"
[ "$(out 'ls /tmp/ 2>&1; cat /proc/1/comm' | tail -1)" != "" ] && ok "second attach joins" || bad "second attach joins"
wait; sleep 0.5
[ "$("$DOOS" list | awk '$1=="t"{print $2}')" = "stopped" ] && ok "stopped after exit" || bad "stopped after exit"

# none / host modes
"$DOOS" get_or_create --net none n >/dev/null
"$DOOS" attach n -- bash -c 'exec 3<>/dev/tcp/1.1.1.1/443' >/dev/null 2>&1 && bad "net none blocks" || ok "net none blocks"
"$DOOS" delete --yes n >/dev/null
"$DOOS" get_or_create --net host h >/dev/null
"$DOOS" attach h -- bash -c 'exec 3<>/dev/tcp/1.1.1.1/443' >/dev/null 2>&1 && ok "net host works" || bad "net host works"
"$DOOS" delete --yes h >/dev/null

# delete: dry-run by default
"$DOOS" delete t | grep -q "dry run" && [ -d "$DOOS_HOME/containers/t" ] && ok "delete is dry-run" || bad "delete is dry-run"
"$DOOS" delete --yes t | grep -q deleted && [ ! -e "$DOOS_HOME/containers/t" ] && ok "delete --yes removes" || bad "delete --yes removes"

# ---- 1.0: skeleton, seeded /etc, uid mapping (host mode, container t was deleted above)
"$DOOS" get_or_create s >/dev/null 2>&1
outs() { "$DOOS" attach s -- sh -c "$1" 2>&1; }
[ "$(outs 'touch /usr/bin/doos-x && echo y')" = "y" ] && [ ! -e /usr/bin/doos-x ] && ok "skeleton: write into /usr/bin" || bad "skeleton: write into /usr/bin"
[ "$(outs 'stat -c %u /etc/shells')" = "0" ] && ok "/etc owned by container root" || bad "/etc owned by container root"
[ "$(outs 'chown 100:100 /root && stat -c %u:%g /root')" = "100:100" ] && ok "subuid: chown to other ids" || bad "subuid: chown to other ids"
[ "$(outs 'ls /var/lib/dpkg/status >/dev/null && echo y')" = "y" ] && ok "/var/lib/dpkg present" || bad "/var/lib/dpkg present"
"$DOOS" get_or_create --ids single s1 >/dev/null 2>&1
[ "$("$DOOS" attach s1 -- cat /proc/self/uid_map | wc -l)" = "1" ] && ok "ids single: one mapping" || bad "ids single: one mapping"
"$DOOS" attach s1 -- sh -c 'cat /etc/apt/apt.conf.d/99doos-sandbox' 2>&1 | grep -q 'Sandbox::User "root"' && ok "ids single: apt sandbox override" || bad "ids single: apt sandbox override"
check "ids fixed at creation"       bash -c "! '$DOOS' get_or_create --ids subuid s1"
check "bad size rejected"           bash -c "! '$DOOS' get_or_create --size 1x z1"
check "size below minimum rejected" bash -c "! '$DOOS' get_or_create --size 1m z2"
"$DOOS" attach s -- sh -c 'apt-get update >/dev/null 2>&1; apt-get install -y --no-install-recommends cowsay >/dev/null 2>&1; dpkg --audit && /usr/games/cowsay ok >/dev/null' && ok "host mode: apt install completes" || bad "host mode: apt install completes"
[ ! -e /usr/games/cowsay ] && ok "host untouched by apt install" || bad "host untouched by apt install"
"$DOOS" delete --yes s >/dev/null; "$DOOS" delete --yes s1 >/dev/null

# ---- images
echo "--- images (network)"
"$DOOS" image list | grep -q "alpine.*available" && ok "image list shows catalog" || bad "image list shows catalog"
check "http url refused"            bash -c "! '$DOOS' image add http://example.com/x.tar.gz"
check "url without sha256 refused"  bash -c "! '$DOOS' image add https://example.com/x.tar.gz"
check "unknown image refused"       bash -c "! '$DOOS' get_or_create --image nosuch i0"
tmpd=$(mktemp -d); mkdir -p $tmpd/r/bin; echo hi > $tmpd/r/bin/f; tar -C $tmpd/r -czf $tmpd/mini.tar.gz .
check "wrong sha256 rejected"       bash -c "! '$DOOS' image add --sha256 $(printf '0%.0s' $(seq 64)) $tmpd/mini.tar.gz mini"
[ ! -e "$DOOS_HOME/images/mini" ] && [ ! -e "$DOOS_HOME/images/.tmp-mini" ] && ok "failed add leaves nothing" || bad "failed add leaves nothing"
check "local tar added"             "$DOOS" image add $tmpd/mini.tar.gz mini
rm -rf $tmpd; "$DOOS" image delete --yes mini >/dev/null

"$DOOS" attach --image alpine a1 -- true >/dev/null 2>&1
"$DOOS" image list | grep -q "alpine.*installed" && ok "image auto-fetched on demand" || bad "image auto-fetched on demand"
[ "$("$DOOS" attach a1 -- sh -c '. /etc/os-release; echo $ID')" = "alpine" ] && ok "alpine image runs" || bad "alpine image runs"
"$DOOS" attach a1 -- sh -c 'apk add --no-cache jq >/dev/null 2>&1 && jq --version' | grep -q jq && ok "alpine: apk add" || bad "alpine: apk add"
[ "$("$DOOS" attach a1 -- sh -c 'chown 100:100 /root && stat -c %u /root')" = "100" ] && ok "image: subuid chown" || bad "image: subuid chown"
"$DOOS" attach a1 -- sh -c 'exec 3<>/dev/tcp/1.1.1.1/443' >/dev/null 2>&1; "$DOOS" attach a1 -- sh -c 'wget -qO- https://example.com | grep -q html' && ok "image: network + dns" || bad "image: network + dns"
check "image delete refused while used" bash -c "! '$DOOS' image delete --yes alpine"
check "image in use is a dry run too"   bash -c "! '$DOOS' image delete alpine"
"$DOOS" get_or_create --image alpine --ids single a2 >/dev/null 2>&1 && bad "image ids mismatch rejected" || ok "image ids mismatch rejected"
"$DOOS" delete --yes a1 >/dev/null
"$DOOS" image delete alpine | grep -q "dry run" && [ -d "$DOOS_HOME/images/alpine" ] && ok "image delete is dry-run" || bad "image delete is dry-run"
"$DOOS" image delete --yes alpine | grep -q deleted && [ ! -e "$DOOS_HOME/images/alpine" ] && ok "image delete --yes removes" || bad "image delete --yes removes"

"$DOOS" attach --image ubuntu u1 -- sh -c 'apt-get update >/dev/null 2>&1; apt-get install -y --no-install-recommends cowsay >/dev/null 2>&1; dpkg --audit && /usr/games/cowsay ok >/dev/null' && ok "ubuntu image: apt install completes" || bad "ubuntu image: apt install completes"
"$DOOS" delete --yes u1 >/dev/null; "$DOOS" image delete --yes ubuntu >/dev/null

# ---- size cap (needs cgroup v2 delegation; takes about 40 s because the scan interval has a 10 s floor)
echo "--- size cap"
"$DOOS" get_or_create --image alpine --size 64m cap >/dev/null 2>&1
"$DOOS" attach cap -- sh -c 'dd if=/dev/zero of=/root/big bs=1M count=100 2>/dev/null; sleep 40' >/tmp/doos-cap.$$ 2>&1 &
sleep 15
if grep -q "FROZEN" /tmp/doos-cap.$$; then
  ok "size cap freezes"
  "$DOOS" attach cap -- rm /root/big >/dev/null 2>&1; sleep 12
  grep -q thawed /tmp/doos-cap.$$ && ok "size cap thaws after cleanup" || bad "size cap thaws after cleanup"
elif grep -q "cannot freeze" /tmp/doos-cap.$$; then
  echo "skip size cap: no cgroup delegation here (warn-only mode confirmed)"
else
  bad "size cap freezes"
fi
kill %% 2>/dev/null; wait 2>/dev/null; rm -f /tmp/doos-cap.$$
"$DOOS" delete --yes cap >/dev/null 2>&1; "$DOOS" image delete --yes alpine >/dev/null 2>&1

echo "passed=$pass failed=$fail"
[ "$fail" -eq 0 ]