#!/usr/bin/env bash
# prod-write-guard.sh 的迴歸測試。
# 🔴 必須寫成檔案跑：這道閘會擋掉「含有它要擋的字串」的指令本身
#    ⇒ 直接在 Bash 裡打測試，會被自己擋下（2026-08-12 實撞）。
HOOK="$1"
mk(){ python3 -c "import json,sys;print(json.dumps({'tool_name':'Bash','tool_input':{'command':sys.argv[1]}}))" "$1"; }
PASS=0; FAIL=0
t(){ # t <期望 block|pass> <說明> <指令>
  mk "$3" | "$HOOK" >/dev/null 2>&1; rc=$?
  got=$([ $rc -eq 2 ] && echo block || echo pass)
  if [ "$got" = "$1" ]; then echo "  ✅ $2"; PASS=$((PASS+1))
  else echo "  ❌ $2 —— 期望 $1，實得 $got"; FAIL=$((FAIL+1)); fi
}

H='https://arcrun-kbdb.leo21c.workers.dev'
DASH_D='-d'

echo "── 該放行（唯讀）──"
t pass "純 GET" "curl -s $H/templates"
t pass "GET + tr -d（本次實撞的誤攔）" "ACC=\$(grep -oE '^X=.' f | tr $DASH_D '\\r'); curl -s $H/templates"
t pass "GET + cut -d=" "A=\$(cut ${DASH_D}= -f2 f); curl -s $H/templates"
t pass "GET + sort -d / xargs -d" "ls | sort $DASH_D | xargs $DASH_D '\\n' echo; curl -s $H/entries"
t pass "GET 帶 Bearer 標頭" "curl -s -H 'Authorization: Bearer xxx' $H/templates?limit=1"
t pass "打 staging" "curl -X POST https://arcrun-rag-installer-staging.workers.dev/x $DASH_D '{}'"
t pass "打 youlin 測試場" "curl -X POST https://arcrun-cypher-executor.youlin-hsieh-dev.workers.dev/x $DASH_D '{}'"
t pass "打 Gitea（不是實例）" "curl -X POST https://git.uncle6.me/api/v1/repos/Leo/x/issues $DASH_D '{}'"

echo "── 該擋（寫入）──"
t block "POST 到實例" "curl -X POST $H/entries $DASH_D '{}'"
t block "PUT 到實例" "curl -X PUT $H/entries/1 --data '{}'"
t block "DELETE 到實例" "curl -X DELETE $H/entries/1"
t block "POST 且同時有 tr -d（剪字後仍該擋）" "cat f | tr $DASH_D '\\r' | curl -X POST $H/webhooks/named $DASH_D @-"
t block "wrangler deploy" "npx wrangler deploy --name arcrun-kbdb"

# ── 2026-08-13：「執行它」vs「談論它」───────────────────────────────
# 實撞：把 #108 的驗收證據留言到 Gitea，正文引述了那個指令名 ⇒ 一則留言被當成部署擋掉。
# 這批測資的挑法是「本 repo 現行真的會出現的形狀」，不是我自己挑好抓的壞例子
#   ——PR #87 那道假綠閘就是敗在後者（14 條全過，卻漏掉 repo 實際在用的呼叫寫法）。
ACR_U='acr up''date'   # 拆開寫：否則這支測試檔自己會被閘擋住（它也是一條 Bash 指令）
ACR_P='acr pu''sh'
WR_D='wrangler dep''loy'

echo "── 該放行（只是談論，不是執行）──"
t pass "heredoc 正文引述（本次實撞）" \
  "B=\$(cat <<'EOF'
更新指令 \`$ACR_U --force\` 印出了 ARCRUN_NAMESPACE
EOF
); curl -X POST https://git.uncle6.me/api/v1/repos/Leo/Arcrun/issues/108/comments $DASH_D \"\$B\""
t pass "commit 訊息裡提到" "git commit -m '修好 $ACR_U 的命名空間注入'"
t pass "markdown code span（反引號）" "printf '%s' '看 \`$ACR_U\` 的輸出'"
t pass "grep 它的名字" "grep -n '$ACR_P' .claude/hooks/prod-write-guard.sh"
t pass "文章裡提到 $WR_D" "printf '%s' '# 為什麼 $WR_D 要擋'"
t pass "acr 唯讀子指令" "acr status --json"
t pass "acr whoami" "acr whoami"

echo "── 該擋（真的在指令位置執行）──"
t block "行首" "$ACR_U --force"
t block "&& 之後" "cd /x && $ACR_U"
t block "; 之後" "echo hi; $ACR_P workflow.yaml"
t block "管線之後" "cat x.yaml | $ACR_P -"
t block "bash -c 引號裡" "bash -c \"$ACR_U --force\""
t block "\$( ) 裡" "OUT=\$($ACR_U 2>&1)"
t block "npx 前綴" "npx $WR_D --name arcrun-kbdb"
t block "sudo 前綴" "sudo $ACR_U"
t block "heredoc 之後的真指令（剝內文不能連指令一起剝）" \
  "cat <<'EOF' > note.md
只是筆記
EOF
$ACR_U --force"

echo
echo "結果：通過 $PASS ／ 失敗 $FAIL"
[ $FAIL -eq 0 ] || exit 1