#!/usr/bin/env bash
set -Eeuo pipefail
: "${WATERFALL_WIKI_IMAGE:?Build the runtime image first}"
: "${WATERFALL_WIKI_TEST_IMAGE:?Build the integration image first}"
export GITEA_RUN_ID="${GITEA_RUN_ID:-$$}"
export COMPOSE_PROJECT_NAME="prompt-ci-$GITEA_RUN_ID"
export PG_PORT=0 S3_PORT=0 WEB_PORT=0 WEB_BIND_ADDRESS=127.0.0.1
TEST_ENV=$(mktemp)
chmod 0600 "$TEST_ENV"
COMPOSE_FILES=(-f compose.yml)
STUDIO_SERVICES=()
if [[ -n "${STUDIO_REVIEW_IMAGE:-}" ]]; then
 COMPOSE_FILES+=(-f compose.creative-review.yml)
 STUDIO_SERVICES+=(prompt-studio)
fi
compose(){ docker compose -p "$COMPOSE_PROJECT_NAME" --env-file "$TEST_ENV" "${COMPOSE_FILES[@]}" "$@"; }
cleanup(){
 code=$?
 trap - EXIT INT TERM
 if [ "$code" -ne 0 ]; then
  echo 'Runner pressure at integration failure (before disposable stack cleanup)'
  uptime || true
  free -m || true
  df -h / || true
  for resource in cpu memory io; do cat "/proc/pressure/$resource" || true; done
  timeout 10s docker stats --no-stream --format '{{.Name}} cpu={{.CPUPerc}} memory={{.MemUsage}} io={{.BlockIO}} pids={{.PIDs}}' || true
  compose logs --tail 160 waterfall-wiki waterfall-wiki-worker "${STUDIO_SERVICES[@]}" || true
 fi
 cleanup_code=0
 bash scripts/cleanup-integration.sh || cleanup_code=$?
 rm -f "$TEST_ENV"
 if [ "$code" -ne 0 ]; then exit "$code"; fi
 exit "$cleanup_code"
}
trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
# Random credentials exist only for this disposable stack; no host Node required.
docker run --rm --entrypoint node "$WATERFALL_WIKI_IMAGE" -e "const c=require('crypto');const hex=()=>c.randomBytes(24).toString('hex');console.log('POSTGRES_PASSWORD='+hex()+'\nS3_ACCESS_KEY='+hex()+'\nS3_SECRET_KEY='+hex())" > "$TEST_ENV"
# Explicitly isolate legacy unauthenticated integration coverage; production fails closed.
printf '\nAUTH_DISABLED_FOR_TESTS=true\n' >> "$TEST_ENV"
if [[ -n "${STUDIO_REVIEW_IMAGE:-}" ]]; then printf '\nACCOUNT_PUBLIC_ORIGIN=http://waterfall-wiki:3000\nAUTH_COOKIE_SECURE=false\n' >> "$TEST_ENV"; fi
compose up -d --no-build --wait --wait-timeout 120 postgres objects
compose run --rm --no-deps migrate
compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki waterfall-wiki-worker "${STUDIO_SERVICES[@]}"
# The test runner calls the actual non-root production web/worker containers.
compose run --rm --no-deps tests
compose exec -T waterfall-wiki node container-health.mjs
compose exec -T waterfall-wiki-worker sh -c 'test "$(id -u)" -ne 0 && ffmpeg -version >/dev/null'

# Repeat route and login checks with production authentication enabled.
printf '\nAUTH_CONFIG_FILE=/auth/config.json\nAUTH_COOKIE_SECURE=false\n' >> "$TEST_ENV"
compose run --rm --no-deps auth-admin
compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki
compose exec -T waterfall-wiki node auth-cli.cjs exercise
compose restart waterfall-wiki
compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki
compose exec -T waterfall-wiki node auth-cli.cjs verify