#!/bin/sh
# keyproxy end-to-end smoke: builds in the digest-pinned builder, starts
# `keyproxy serve` in a container on host port 8082 with a throwaway
# config + throwaway 0600 env files, drives it from the host with python
# urllib (curl is banned on the host by policy), checks the 401/200/404/
# 400/501/502 paths AND that the server log is redacted (no material,
# every ref masked as <ref>=***), then tears everything down.
set -e
cd "$(dirname "$0")/.."

IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm
NAME="keyproxy-smoke"
PORT="${PORT:-8082}"

./dev.sh build

rm -rf .smoke
mkdir -p .smoke
chmod 0700 .smoke

# Throwaway material (smoke values only; never real secrets).
cat > .smoke/keyproxy.env <<'EOF'
KEYPROXY_TOKEN=smoke-bearer-token-1111
EOF
cat > .smoke/creds.env <<'EOF'
API_KEY=smoke-secret-material-2222
OTHER=smoke-other-3333
EOF
chmod 0600 .smoke/keyproxy.env .smoke/creds.env

# In-container bind is all-interfaces ONLY because docker -p publishing
# is the boundary here; the host default (and example config) stays
# loopback.
cat > .smoke/keyproxy.toml <<EOF
listen = ":8082"

[auth]
token_ref = "mpk-keyproxy-self"

[refs."mpk-keyproxy-self"]
backend = "file"
source = "/h/.smoke/keyproxy.env"
key = "KEYPROXY_TOKEN"

[refs."mpk-smoke"]
backend = "file"
source = "/h/.smoke/creds.env"
key = "API_KEY"

[refs."mpk-smoke-env"]
backend = "env"
source = "KEYPROXY_SMOKE_ENV"

[refs."mpk-smoke-bw"]
backend = "bitwarden"
source = "sm://p/smoke"
key = "API_KEY"

[refs."mpk-smoke-vault"]
backend = "vault"
source = "secret/data/smoke"
key = "API_KEY"
EOF

docker rm -f "$NAME" >/dev/null 2>&1 || true
docker run -d --name "$NAME" -p "$PORT:8082" \
    -v "$PWD:/h" -w /h -u "$(id -u):$(id -g)" -e HOME=/tmp \
    -e KEYPROXY_SMOKE_ENV=smoke-env-material-4444 \
    "$IMAGE" /h/bin/keyproxy serve -config /h/.smoke/keyproxy.toml

cleanup() {
    docker rm -f "$NAME" >/dev/null 2>&1 || true
}
trap cleanup EXIT

echo "--- probing http://127.0.0.1:$PORT (python urllib; curl banned on host) ---"
BASE_URL="http://127.0.0.1:$PORT" KEYPROXY_TOKEN="smoke-bearer-token-1111" \
    python3 smoke/probe.py
probe_rc=$?

echo "--- server log (redaction check) ---"
LOG="$(docker logs "$NAME" 2>&1)"
echo "$LOG"

if echo "$LOG" | grep -q 'smoke-secret-material-2222\|smoke-env-material-4444\|smoke-bearer-token-1111'; then
    echo "FAIL: server log contains material"
    exit 1
fi
if ! echo "$LOG" | grep -q 'ref=mpk-smoke=\*\*\*'; then
    echo "FAIL: server log does not mask refs as <ref>=***"
    exit 1
fi

exit "$probe_rc"