#!/usr/bin/env bash
set -Eeuo pipefail
: "${WATERFALL_WIKI_IMAGE:?Build runtime image first}"
: "${WATERFALL_WIKI_TEST_IMAGE:?Build integration image first}"
export GITEA_RUN_ID="${GITEA_RUN_ID:-$$}"
[[ "$GITEA_RUN_ID" =~ ^[1-9][0-9]*$ ]]
# Only one candidate uses the shared test slot at a time. Production is project prompt.
exec 8>/var/lock/prompt-ci-integration.lock
flock -w 900 8
export COMPOSE_PROJECT_NAME=prompt-ci-shared
export PG_PORT=0 S3_PORT=0 WEB_PORT=0 WEB_BIND_ADDRESS=127.0.0.1
STATE=/var/lib/prompt-ci
umask 077
mkdir -p "$STATE"
if [ ! -s "$STATE/credentials.env" ]; then
 docker run --rm --entrypoint node "$WATERFALL_WIKI_IMAGE" -e "const c=require('crypto');const hex=()=>c.randomBytes(24).toString('hex');console.log('POSTGRES_PASSWORD='+hex()+'\nS3_ACCESS_KEY='+hex()+'\nS3_SECRET_KEY='+hex())" > "$STATE/credentials.env.tmp"
 mv "$STATE/credentials.env.tmp" "$STATE/credentials.env"
fi
TEST_ENV=$(mktemp)
cat "$STATE/credentials.env" > "$TEST_ENV"
printf '\nS3_BUCKET=ci-%s\nAUTH_DISABLED_FOR_TESTS=true\nACCOUNT_PUBLIC_ORIGIN=http://waterfall-wiki:3000\nAUTH_COOKIE_SECURE=false\n' "$GITEA_RUN_ID" >> "$TEST_ENV"
compose(){ docker compose -p "$COMPOSE_PROJECT_NAME" --env-file "$TEST_ENV" -f compose.yml "$@"; }
cleanup(){
 code=$?
 trap - EXIT
 if [ "$code" -ne 0 ]; then compose logs --tail 100 waterfall-wiki waterfall-wiki-worker || true; fi
 compose stop waterfall-wiki waterfall-wiki-worker || true
 docker run --rm --network prompt-ci-shared_default --env-file "$TEST_ENV" \
  --mount "type=bind,src=$PWD/apps/waterfall-wiki/scripts/cleanup-ci-bucket.mjs,dst=/repo/apps/waterfall-wiki/cleanup-ci-bucket.mjs,readonly" \
  --entrypoint node "$WATERFALL_WIKI_TEST_IMAGE" /repo/apps/waterfall-wiki/cleanup-ci-bucket.mjs || { echo 'CI bucket cleanup failed' >&2; code=1; }
 rm -f "$TEST_ENV"
 exit "$code"
}
trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
# Bootstrap once, otherwise reuse base containers and their volumes.
compose up -d --no-build --no-recreate --wait --wait-timeout 120 postgres objects
compose stop waterfall-wiki waterfall-wiki-worker
id=$(compose ps -q postgres)
[[ "$(docker inspect --format '{{index .Config.Labels "com.docker.compose.project"}}' "$id")" == prompt-ci-shared ]]
# Reset only this dedicated test database; no production volume or database is addressed.
compose exec -T postgres dropdb -U prompt --if-exists --force prompt
compose exec -T postgres createdb -U prompt prompt
compose run --rm --no-deps migrate
compose up -d --no-build --no-deps --wait --wait-timeout 150 waterfall-wiki waterfall-wiki-worker
compose run --rm --no-deps tests
compose exec -T waterfall-wiki node container-health.mjs
compose exec -T waterfall-wiki-worker sh -c 'test "$(id -u)" -ne 0 && ffmpeg -version >/dev/null'

# Repeat route and login checks with production authentication enabled.
printf '\nAUTH_CONFIG_FILE=/auth/config.json\nAUTH_COOKIE_SECURE=false\n' >> "$TEST_ENV"
compose run --rm --no-deps auth-admin
compose up -d --no-build --no-deps --wait --wait-timeout 150 waterfall-wiki
compose exec -T waterfall-wiki node auth-cli.cjs exercise
compose restart waterfall-wiki
compose up -d --no-build --no-deps --wait --wait-timeout 150 waterfall-wiki
compose exec -T waterfall-wiki node auth-cli.cjs verify