#!/usr/bin/env bash

set -euo pipefail

project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
chart_dir="${project_dir}/chart/diun"
rendered_file="${TMPDIR:-/tmp}/diun-chart-rendered.yaml"
example_values="${project_dir}/values.example.yaml"

command -v helm >/dev/null
command -v python3 >/dev/null
helm lint --strict "${chart_dir}"
helm template diun "${chart_dir}" \
  --namespace diun \
  --values "${example_values}" \
  > "${rendered_file}"
python3 - "${rendered_file}" "${project_dir}" "${example_values}" <<'PY'
import sys
import yaml
from pathlib import Path

project_dir = Path(sys.argv[2])
with open(sys.argv[1], encoding="utf-8") as stream:
    objects = [item for item in yaml.safe_load_all(stream) if item]
with (project_dir / "chart/diun/values.yaml").open(encoding="utf-8") as stream:
    chart_values = yaml.safe_load(stream)
with (project_dir / "chart/diun/Chart.yaml").open(encoding="utf-8") as stream:
    chart_metadata = yaml.safe_load(stream)
with open(sys.argv[3], encoding="utf-8") as stream:
    example_values = yaml.safe_load(stream)

def one(kind, name):
    matches = [obj for obj in objects if obj.get("kind") == kind and obj.get("metadata", {}).get("name") == name]
    assert len(matches) == 1, f"expected one {kind}/{name}, found {len(matches)}"
    return matches[0]

deployment = one("Deployment", "diun")
pod = deployment["spec"]["template"]
pod_spec = pod["spec"]
container = next(item for item in pod_spec["containers"] if item["name"] == "diun")
selector = deployment["spec"]["selector"]["matchLabels"]
assert all(pod["metadata"]["labels"].get(key) == value for key, value in selector.items())
assert deployment["spec"]["replicas"] == 1
expected_tag = chart_values["image"].get("tag") or str(chart_metadata["appVersion"])
assert container["image"] == f'{chart_values["image"]["repository"]}:{expected_tag}'
assert all(name in container for name in ("startupProbe", "readinessProbe", "livenessProbe"))
assert all(container[name]["exec"]["command"] == ["diun", "healthcheck"] for name in ("startupProbe", "readinessProbe", "livenessProbe"))
assert container["envFrom"][0]["configMapRef"]["name"] == "diun"
assert pod_spec["serviceAccountName"] == "diun"
assert any(item["name"] == "install-shoutrrr" for item in pod_spec["initContainers"])
assert one("ConfigMap", "diun-matrix-script")["data"].get("send-matrix.sh")
assert one("ClusterRole", "diun")["rules"] == [{"apiGroups": [""], "resources": ["pods"], "verbs": ["get", "list", "watch"]}]
assert one("ClusterRoleBinding", "diun")["roleRef"]["name"] == "diun"
pvc = one("PersistentVolumeClaim", "diun")
assert pvc["spec"]["storageClassName"] == example_values["persistence"]["storageClassName"]
assert pod_spec["volumes"][0]["persistentVolumeClaim"]["claimName"] == pvc["metadata"]["name"]
assert not any(item.get("kind") == "Secret" for item in objects), "chart must reference secrets, never render their data"
volume = next(item for item in pod_spec["volumes"] if item["name"] == "matrix-token")
assert volume["secret"]["secretName"] == example_values["matrix"]["tokenSecretName"]
mount = next(item for item in container["volumeMounts"] if item["name"] == "matrix-token")
assert mount["readOnly"] is True
PY