#!/usr/bin/env bash
set -Eeuo pipefail
: "${WATERFALL_WIKI_IMAGE:?Build the runtime image first}"
: "${WATERFALL_WIKI_TEST_IMAGE:?Build the integration image first}"
export COMPOSE_PROJECT_NAME="prompt-ci-${GITEA_RUN_ID:-$$}"
export PG_PORT=0 S3_PORT=0 WEB_PORT=0 WEB_BIND_ADDRESS=127.0.0.1
TEST_ENV=$(mktemp)
chmod 0600 "$TEST_ENV"
COMPOSE_FILES=(-f compose.yml)
STUDIO_SERVICES=()
if [[ -n "${STUDIO_REVIEW_IMAGE:-}" ]]; then
 COMPOSE_FILES+=(-f compose.creative-review.yml)
 STUDIO_SERVICES+=(prompt-studio)
fi
if [[ "${CREATIVE_BROWSER_DIAGNOSTICS:-}" == "1" ]]; then COMPOSE_FILES+=(-f compose.creative-diagnostics.yml); fi
compose(){ docker compose -p "$COMPOSE_PROJECT_NAME" --env-file "$TEST_ENV" "${COMPOSE_FILES[@]}" "$@"; }
diagnostic_state(){
 if [[ "${CREATIVE_BROWSER_DIAGNOSTICS:-}" != "1" ]]; then return; fi
 for metric in /proc/pressure/cpu /proc/pressure/memory /proc/pressure/io; do
  if [[ -r "$metric" ]]; then echo "$metric"; cat "$metric"; fi
 done
 local ids
 ids=$(compose ps -aq)
 if [[ -n "$ids" ]]; then
  docker inspect --format '{{.Name}} OOMKilled={{.State.OOMKilled}} RestartCount={{.RestartCount}} ExitCode={{.State.ExitCode}}' $ids
  docker stats --no-stream --format '{{.Name}} CPU={{.CPUPerc}} Memory={{.MemUsage}} PIDs={{.PIDs}}' $ids
 fi
}
cleanup(){ code=$?; diagnostic_state || true; if [ "$code" -ne 0 ]; then compose logs --tail 160 waterfall-wiki waterfall-wiki-worker "${STUDIO_SERVICES[@]}"; fi; compose down -v --remove-orphans; rm -f "$TEST_ENV"; }
trap cleanup EXIT
# Random credentials exist only for this disposable stack; no host Node required.
docker run --rm --entrypoint node "$WATERFALL_WIKI_IMAGE" -e "const c=require('crypto');const hex=()=>c.randomBytes(24).toString('hex');console.log('POSTGRES_PASSWORD='+hex()+'\nS3_ACCESS_KEY='+hex()+'\nS3_SECRET_KEY='+hex())" > "$TEST_ENV"
# Explicitly isolate legacy unauthenticated integration coverage; production fails closed.
printf '\nAUTH_DISABLED_FOR_TESTS=true\n' >> "$TEST_ENV"
if [[ -n "${STUDIO_REVIEW_IMAGE:-}" ]]; then printf '\nACCOUNT_PUBLIC_ORIGIN=http://waterfall-wiki:3000\nAUTH_COOKIE_SECURE=false\n' >> "$TEST_ENV"; fi
compose up -d --no-build --wait --wait-timeout 120 postgres objects
compose run --rm --no-deps migrate
compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki waterfall-wiki-worker "${STUDIO_SERVICES[@]}"
diagnostic_state
# The test runner calls the actual non-root production web/worker containers.
compose run --rm --no-deps tests
compose exec -T waterfall-wiki node container-health.mjs
compose exec -T waterfall-wiki-worker sh -c 'test "$(id -u)" -ne 0 && ffmpeg -version >/dev/null'

# Repeat route and login checks with production authentication enabled.
printf '\nAUTH_CONFIG_FILE=/auth/config.json\nAUTH_COOKIE_SECURE=false\n' >> "$TEST_ENV"
compose run --rm --no-deps auth-admin
compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki
compose exec -T waterfall-wiki node auth-cli.cjs exercise
compose restart waterfall-wiki
compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki
compose exec -T waterfall-wiki node auth-cli.cjs verify