#!/bin/bash
# The sshpass password below is the disposable test guest's throwaway root
# password (scripts/testing/archsetup-test.conf), reachable only on loopback.
# It is not a credential for anything real.
# Host-side regression driver for the disposable keyring guest.
#   run-regression.sh <label> <daemon-binary-in-guest> [ASAN_OPTIONS]
# Resets the guest fixture with that daemon, runs every probe mode, verifies
# the synthetic secret after each mode, and prints a summary. Output goes to
# stdout; the caller redirects it to a log. Exit 1 on any failure.
set -uo pipefail
label="$1"; daemon="$2"; asan="${3:-}"
here="$(cd "$(dirname "$0")" && pwd)"
PORT="${PORT:-2237}"
ssho=(-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10 -o LogLevel=ERROR -o PreferredAuthentications=password -o PubkeyAuthentication=no)
g() { sshpass -p archsetup ssh "${ssho[@]}" -p "$PORT" root@127.0.0.1 "$@"; }
gcp() { sshpass -p archsetup scp "${ssho[@]}" -P "$PORT" "$@"; }
as_user='runuser -u keyring-test -- env XDG_RUNTIME_DIR=/run/user/1000 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus'
fail=0
echo "=== $label: daemon=$daemon asan=${asan:-none} $(date -Is)"
gcp "$here/probe.py" root@127.0.0.1:/opt/keyring-vm/probe.py >/dev/null
gcp "$here/setup-guest.sh" root@127.0.0.1:/root/setup-guest.sh >/dev/null
g "chmod +x /root/setup-guest.sh; KEYRING_DAEMON_BINARY='$daemon' ASAN_OPTIONS='$asan' /root/setup-guest.sh" || { echo "FIXTURE FAILED"; exit 1; }
since=$(g 'date "+%Y-%m-%d %H:%M:%S"')
owner0=$(g "$as_user busctl --user status org.freedesktop.secrets 2>/dev/null | grep -E '^(PID|Comm)='" | tr '\n' ' ')
echo "owner before: $owner0"
run_mode() {  # mode clients workers burst
  local out
  out=$(g "$as_user python3 /opt/keyring-vm/probe.py $1 --clients $2 --workers $3 --burst $4 --batch 100" 2>&1)
  local rc=$?
  echo "$out" | tail -3
  [ $rc -eq 0 ] || { echo "MODE $1 FAILED (rc=$rc)"; fail=1; }
  local secret
  secret=$(g "$as_user secret-tool lookup purpose keyring-vm" 2>/dev/null)
  if [ "$secret" = "synthetic-vm-secret" ]; then echo "secret after $1: ok"; else echo "secret after $1: FAILED (${secret:-empty})"; fail=1; fi
}
run_mode plain      4000 32 8
run_mode dh         4000 32 8
run_mode invalid    4000 32 8
run_mode disconnect 4000 32 8
run_mode pipeline   4000 32 8
run_mode alias      2000 32 1
run_mode isolation  2000 32 1
owner1=$(g "$as_user busctl --user status org.freedesktop.secrets 2>/dev/null | grep -E '^(PID|Comm)='" | tr '\n' ' ')
echo "owner after:  $owner1"
[ "$owner0" = "$owner1" ] || { echo "OWNER CHANGED"; fail=1; }
echo "--- daemon journal since $since (assertions/aborts/criticals)"
g "journalctl --since '$since' --no-pager -o short-iso 2>/dev/null | grep -E 'gnome-keyring|secrets|asan|AddressSanitizer' | grep -iE 'assert|abort|SIGABRT|critical|sanitizer|ERROR|dumped' | head -40"
if [ -n "$asan" ]; then echo "--- asan logs"; g 'ls /tmp/asan.log* 2>/dev/null && cat /tmp/asan.log* | head -80 || echo "no asan log files"'; fi
echo "=== $label result: $([ $fail -eq 0 ] && echo PASS || echo FAIL) $(date -Is)"
exit $fail