#!/usr/bin/env bash
set -euo pipefail
cd "$(dirname "${BASH_SOURCE[0]}")"
bash -n install.sh deploy.sh create-ci-kubeconfig.sh setup-authentik.sh test.sh
python3 - <<'PY'
import os
import subprocess
import tempfile
from pathlib import Path
import yaml

documents = []
for path in ("storage.yaml", "app.yaml", "pdf-editor.yaml", "ci-deployer.yaml"):
    with open(path, encoding="utf-8") as stream:
        documents.extend(doc for doc in yaml.safe_load_all(stream) if doc)
images = [container["image"] for doc in documents if doc["kind"] == "Deployment"
          for container in doc["spec"]["template"]["spec"]["containers"]]
assert images and all(":" in image and not image.endswith(":latest") for image in images)
editor_ingress = next(doc for doc in documents if doc["kind"] == "Ingress"
                      and doc["metadata"]["name"] == "pdf-editor")
assert editor_ingress["spec"]["rules"][0]["host"] == "scanner.brunner.ninja"
assert editor_ingress["spec"]["rules"][0]["http"]["paths"][0]["path"] == "/pdf"
assert "authentik" in editor_ingress["metadata"]["annotations"]["traefik.ingress.kubernetes.io/router.middlewares"]
config = next(doc["data"]["config.local.js"] for doc in documents
              if doc["kind"] == "ConfigMap" and doc["metadata"]["name"] == "scanner-config")
with tempfile.TemporaryDirectory() as temp:
    root = Path(temp)
    config_path = root / "config.local.js"
    config_path.write_text(config, encoding="utf-8")
    output = root / "staged"
    consume = root / "consume"
    output.mkdir()
    consume.mkdir()
    env = {**os.environ, "SCAN_OUTPUT_DIR": str(output), "PAPERLESS_CONSUME_DIR": str(consume)}
    subprocess.run(["node", "--check", str(config_path)], check=True)
    for name, contents in (("test.pdf", b"%PDF-1.4\nscanner handoff test\n"),
                           ("test.jpg", b"\xff\xd8\xffscanner handoff test\xff\xd9")):
        source = output / name
        source.write_bytes(contents)
        subprocess.run(["node", "-e", "require(process.argv[1]).actions[0].execute({fullname: process.argv[2]}).catch(e => {console.error(e); process.exit(1)})", str(config_path), str(source)], check=True, env=env)
        delivered = list(consume.glob(f"*{name}"))
        assert len(delivered) == 1 and delivered[0].read_bytes() == contents
        assert not source.exists() and not list(consume.glob("*.part"))
print("Manifests valid; images pinned; scanner PDF handoff works.")
PY