#!/usr/bin/env bash
set -euo pipefail

script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=scripts/init-security-origin.sh
. "${script_dir}/init-security-origin.sh"
tmp_dir="$(mktemp -d)"
trap 'rm -rf "$tmp_dir"' EXIT

assert_value() {
    local actual
    actual="$(public_url_read_env_value "$1" CONFIG_SECURITY_ORIGIN)"
    [ "$actual" = "$2" ] || { echo "unexpected origin: $actual" >&2; exit 1; }
}

cat > "$tmp_dir/missing.env" <<'ENV'
CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api
ENV
before="$(shasum -a 256 "$tmp_dir/missing.env" | cut -d ' ' -f 1)"
init_security_origin "$tmp_dir/missing.env" > /dev/null
assert_value "$tmp_dir/missing.env" ''
[ "$before" = "$(shasum -a 256 "$tmp_dir/missing.env" | cut -d ' ' -f 1)" ]
first_hash="$(shasum -a 256 "$tmp_dir/missing.env" | cut -d ' ' -f 1)"
init_security_origin "$tmp_dir/missing.env" > /dev/null
[ "$first_hash" = "$(shasum -a 256 "$tmp_dir/missing.env" | cut -d ' ' -f 1)" ]

cat > "$tmp_dir/sample.env" <<'ENV'
CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api
CONFIG_SECURITY_ORIGIN=http://127.0.0.1,http://localhost
ENV
init_security_origin "$tmp_dir/sample.env" > /dev/null
assert_value "$tmp_dir/sample.env" ''

cat > "$tmp_dir/preserved.env" <<'ENV'
CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api
CONFIG_SECURITY_ORIGIN=https://zaowua.com,https://www.zaowua.com
ENV
before="$(shasum -a 256 "$tmp_dir/preserved.env" | cut -d ' ' -f 1)"
init_security_origin "$tmp_dir/preserved.env" > /dev/null
[ "$before" = "$(shasum -a 256 "$tmp_dir/preserved.env" | cut -d ' ' -f 1)" ]

for invalid in '*' 'https://zaowua.com/api' 'https://zaowua.com,' 'https://user:pass@zaowua.com'; do
    printf 'CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api\nCONFIG_SECURITY_ORIGIN=%s\n' "$invalid" > "$tmp_dir/invalid.env"
    if init_security_origin "$tmp_dir/invalid.env" > /dev/null 2>&1; then
        echo "accepted invalid origin: $invalid" >&2
        exit 1
    fi
done

echo 'Security origin migration tests passed'