#!/usr/bin/env bash
set -Eeuo pipefail
: "${WATERFALL_WIKI_IMAGE:?Build the runtime image first}"
: "${WATERFALL_WIKI_TEST_IMAGE:?Build the integration image first}"
export COMPOSE_PROJECT_NAME="prompt-ci-${GITEA_RUN_ID:-$$}"
export PG_PORT=0 S3_PORT=0 WEB_PORT=0 WEB_BIND_ADDRESS=127.0.0.1
TEST_ENV=$(mktemp)
chmod 0600 "$TEST_ENV"
compose(){ docker compose -p "$COMPOSE_PROJECT_NAME" --env-file "$TEST_ENV" -f compose.yml "$@"; }
cleanup(){ code=$?; if [ "$code" -ne 0 ]; then compose logs --tail 160 waterfall-wiki waterfall-wiki-worker; fi; compose down -v --remove-orphans; rm -f "$TEST_ENV"; }
trap cleanup EXIT
# Random credentials exist only for this disposable stack; no host Node required.
docker run --rm --entrypoint node "$WATERFALL_WIKI_IMAGE" -e "const c=require('crypto');const hex=()=>c.randomBytes(24).toString('hex');console.log('POSTGRES_PASSWORD='+hex()+'\nS3_ACCESS_KEY='+hex()+'\nS3_SECRET_KEY='+hex())" > "$TEST_ENV"
compose up -d --no-build --wait --wait-timeout 120 postgres objects
compose run --rm --no-deps migrate
compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki waterfall-wiki-worker
# The test runner calls the actual non-root production web/worker containers.
compose run --rm --no-deps tests
compose exec -T waterfall-wiki node container-health.mjs
compose exec -T waterfall-wiki-worker sh -c 'test "$(id -u)" -ne 0 && ffmpeg -version >/dev/null'

# Repeat route and login checks with production authentication enabled.
printf '\nAUTH_CONFIG_FILE=/auth/config.json\nAUTH_COOKIE_SECURE=false\n' >> "$TEST_ENV"
compose run --rm --no-deps auth-admin
compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki
compose exec -T waterfall-wiki node auth-cli.cjs exercise
compose restart waterfall-wiki
compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki
compose exec -T waterfall-wiki node auth-cli.cjs verify