#!/usr/bin/env bash
# Offline tests for catalogue-publish (version-code.sh + dry-run via run.sh).
set -u
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
FAILS=0
ok(){ echo "PASS: $1"; }; bad(){ echo "FAIL: $1"; FAILS=$((FAILS+1)); }
vc_eq(){ local o; o="$(bash "$HERE/version-code.sh" "$1" 2>/dev/null)"; [ "$o" = "$2" ] && ok "$1 -> $2" || bad "$1 -> '$o' (want $2)"; }
vc_fail(){ bash "$HERE/version-code.sh" "$1" >/dev/null 2>&1 && bad "$1 should fail" || ok "$1 rejected"; }
vc_eq 0.1.5 1005; vc_eq 1.6.0 1006000; vc_eq 12.0.999 12000999
vc_fail 1.2.1000; vc_fail 1.2; vc_fail v1.2.3; vc_fail 1.2.3-beta.1

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
printf 'x' > "$TMP/App-1.0.0.nupkg"
SECRET="s3cr3t-PUBLISH-KEY-do-not-leak"
OUT="$(GITHUB_ACTION_PATH="$HERE" INPUT_APP=silvermail INPUT_FILE="$TMP/App-1.0.0.nupkg" \
  INPUT_PLATFORM=windows INPUT_ARCH=x64 INPUT_FORMAT=nupkg INPUT_VERSION=1.0.0 INPUT_VERSION_CODE= \
  INPUT_CHANNEL=beta INPUT_NOTES_FILE= INPUT_SIGNER_IDENTITY= INPUT_CATALOGUE_URL= INPUT_DRY_RUN=true \
  CATALOGUE_PUBLISH_KEY="$SECRET" bash "$HERE/run.sh" 2>&1)"; RC=$?
[ $RC -eq 0 ] && ok "dry-run exit 0" || bad "dry-run rc=$RC: $OUT"
for n in Platform=Windows Format=Nupkg VersionCode=1000000 AppSlug=silvermail; do
  printf '%s' "$OUT" | grep -qF -- "$n" && ok "dry-run has $n" || bad "dry-run missing $n"; done
printf '%s' "$OUT" | grep -qF -- "$SECRET" && bad "key leaked" || ok "key not printed"

# -K must not use process substitution (breaks native curl under Git Bash).
grep -nE -- '-K[[:space:]]+<\(' "$HERE/publish-to-catalogue.sh" >/dev/null && bad "uses -K <(...)" || ok "no process substitution for -K"

# Fake curl: header must arrive on stdin, never in argv.
mkdir "$TMP/bin"
cat > "$TMP/bin/curl" <<'F'
#!/usr/bin/env bash
out=""; k=""
while [ $# -gt 0 ]; do case "$1" in -o) out="$2"; shift 2;; -K) k="$2"; shift 2;; *) printf '%s
' "$1" >> "$FAKE_ARGS"; shift;; esac; done
printf '%s' "$k" > "$FAKE_K"
cat > "$FAKE_STDIN"
echo '{}' > "$out"; printf 201
F
export FAKE_ARGS="$TMP/args" FAKE_K="$TMP/k" FAKE_STDIN="$TMP/stdin"; : > "$FAKE_ARGS"
PATH="$TMP/bin:$PATH" CATALOGUE_PUBLISH_KEY="$SECRET" bash "$HERE/publish-to-catalogue.sh"   --slug a --platform windows --arch x64 --format nupkg --version 1.0.0 --version-code 1 --channel beta "$TMP/App-1.0.0.nupkg" >/dev/null 2>&1   && ok "fake-curl publish exit 0" || bad "fake-curl publish failed"
[ "$(cat "$TMP/k")" = "-" ] && ok "-K -" || bad "-K arg is '$(cat "$TMP/k")'"
grep -qF "Authorization: Bearer $SECRET" "$TMP/stdin" && ok "header on stdin" || bad "header not on stdin"
grep -qF "$SECRET" "$TMP/args" && bad "key in argv" || ok "key not in argv"
exit $FAILS