#!/bin/bash
# stage-before-prod-guard 的測試（inkstone/ISEP#30 群組——heredoc body 不算數）
# 判準：真的碰 prod 出貨鏈、沒有 stage 驗證紀錄要擋；讀取/查證/heredoc body 不准擋；
# 帶 staging 字樣、6 小時內驗過 stage 的要放行。
cd "$(dirname "$0")/.." || exit 1
H=hooks/stage-before-prod-guard.sh
PASS=0; FAIL=0
run(){ # $1=want $2=cmd
  printf '%s' "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$2")}}" \
    | bash "$H" >/dev/null 2>&1
  got=$?
  if [ "$got" = "$1" ]; then PASS=$((PASS+1)); printf '  ✅ '; else FAIL=$((FAIL+1)); printf '  ❌ '; fi
  printf 'want=%s got=%s  %.72s\n' "$1" "$got" "$2"
}

rm -f /tmp/.stage-verified /tmp/.stage-ok-by-leo

echo "── 該擋：真的在動 prod 出貨鏈，沒有 stage 驗證紀錄 ──"
run 2 'wrangler deploy --name arcrun-rag-bundles-installer'
run 2 'git push gitea arcrun-rag-bundles-installer main'
run 2 'scripts/github-arm.sh "出貨" 30'
run 2 'echo go && scripts/github-arm.sh "出貨" 30'

echo "── 不該擋：讀取／查證／演練 ──"
run 0 'sed -n "1,40p" scripts/github-arm.sh'
run 0 'git commit -m "照 scripts/github-arm.sh 解保險流程"'
run 0 'grep -n "wrangler deploy" hooks/stage-before-prod-guard.sh'
run 0 'BASE="https://cdn.jsdelivr.net/gh/x/arcrun-rag-bundles@abc"; curl -s "$BASE/manifest.json"'
run 0 'wrangler deploy --dry-run'
run 0 'wrangler deploy --env staging'

echo "── 不該擋：heredoc body 只是提到 ──"
run 0 "$(printf 'cat > docs/TESTING.md <<%sEOF%s\nexample: wrangler deploy then scripts/github-arm.sh to ship arcrun-rag-bundles\nEOF\n' "'" "'")"

echo "── 6 小時內驗過 stage，且 leo 已解 GitHub 保險 → 放行 ──"
# 條件 ① .github-armed 與條件 ② stage-verified 缺一不可，兩個都要造出來才測得到「放行」那條路
touch .github-armed
date +%s > /tmp/.stage-verified
run 0 'wrangler deploy --name arcrun-rag-bundles-installer'
rm -f /tmp/.stage-verified .github-armed

echo "── 只驗過 stage、沒解 GitHub 保險 → 還是要擋（條件缺一不可）──"
date +%s > /tmp/.stage-verified
run 2 'wrangler deploy --name arcrun-rag-bundles-installer'
rm -f /tmp/.stage-verified

echo
echo "$PASS/$((PASS+FAIL)) 通過"
[ "$FAIL" -eq 0 ]