#!/bin/sh
# Hermetic negative-path tests for the sourceable Kepr release-gate helpers.
# No Android SDK, Gradle project, signing key, network, or APK is required.
set -eu

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
# shellcheck source=scripts/kepr-build-helpers.sh
. "$SCRIPT_DIR/kepr-build-helpers.sh"

TEMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/peach-kepr-helper-tests.XXXXXX")
trap 'trash "$TEMP_ROOT"' EXIT HUP INT TERM

fail() {
    printf 'FAIL: %s\n' "$1" >&2
    exit 1
}

expect_failure() {
    if "$@"; then
        fail "expected failure: $*"
    fi
}

touch_tools() {
    mkdir -p "$TEMP_ROOT/sdk/build-tools/$1"
    : > "$TEMP_ROOT/sdk/build-tools/$1/aapt2"
    chmod +x "$TEMP_ROOT/sdk/build-tools/$1/aapt2"
}

touch_tools 34.0.0
touch_tools 35.0.0
touch_tools 35.1.0-preview
touch_tools 36.0.0-rc1
touch_tools latest
touch_tools arbitrary

selected=$(find_stable_build_tools_dir "$TEMP_ROOT/sdk")
[ "$selected" = "$TEMP_ROOT/sdk/build-tools/35.0.0" ] ||
    fail "stable build-tools selection chose '$selected'"
for rejected in latest 35.1.0-preview 36.0.0-rc1 arbitrary 35 35.0; do
    expect_failure is_stable_build_tools_basename "$rejected"
done

printf '2.8.4\n' > "$TEMP_ROOT/VERSION"
[ "$(read_root_semver "$TEMP_ROOT/VERSION")" = "2.8.4" ] || fail "valid VERSION was rejected"
printf '2.8.4\n2.8.5\n' > "$TEMP_ROOT/VERSION.ambiguous"
expect_failure read_root_semver "$TEMP_ROOT/VERSION.ambiguous"
printf '2.8\n' > "$TEMP_ROOT/VERSION.malformed"
expect_failure read_root_semver "$TEMP_ROOT/VERSION.malformed"

cat > "$TEMP_ROOT/metadata.json" <<'JSON'
{
  "applicationId": "com.peachpasswords",
  "elements": [
    {"versionCode": 240146, "versionName": "2.8.4", "outputFile": "app-arm64-v8a-release.apk"},
    {"versionCode": 240146, "versionName": "2.8.4", "outputFile": "app-x86_64-release.apk"}
  ]
}
JSON
printf "package: name='com.peachpasswords' versionCode='240146' versionName='2.8.4'\nnative-code: 'arm64-v8a'\n" > "$TEMP_ROOT/badging"
validate_release_metadata "$TEMP_ROOT/metadata.json" "$TEMP_ROOT/badging" 2.8.4 com.peachpasswords app-arm64-v8a-release.apk arm64-v8a

printf '{"applicationId":"com.peachpasswords",' > "$TEMP_ROOT/metadata.malformed"
expect_failure validate_release_metadata "$TEMP_ROOT/metadata.malformed" "$TEMP_ROOT/badging" 2.8.4 com.peachpasswords app-arm64-v8a-release.apk arm64-v8a
cat > "$TEMP_ROOT/metadata.duplicate.json" <<'JSON'
{"applicationId":"com.peachpasswords","applicationId":"com.peachpasswords","elements":[{"versionCode":240146,"versionName":"2.8.4"}]}
JSON
expect_failure validate_release_metadata "$TEMP_ROOT/metadata.duplicate.json" "$TEMP_ROOT/badging" 2.8.4 com.peachpasswords app-arm64-v8a-release.apk arm64-v8a
cat > "$TEMP_ROOT/metadata.ambiguous.json" <<'JSON'
{"applicationId":"com.peachpasswords","elements":[{"versionCode":240146,"versionName":"2.8.4"},{"versionCode":240147,"versionName":"2.8.4"}]}
JSON
expect_failure validate_release_metadata "$TEMP_ROOT/metadata.ambiguous.json" "$TEMP_ROOT/badging" 2.8.4 com.peachpasswords app-release.apk arm64-v8a
expect_failure validate_release_metadata "$TEMP_ROOT/metadata.json" "$TEMP_ROOT/badging" 2.8.5 com.peachpasswords app-arm64-v8a-release.apk arm64-v8a
printf "package: name='com.peachpasswords' versionCode='240146' versionName='2.8.5'\n" > "$TEMP_ROOT/badging.mismatch"
printf "native-code: 'arm64-v8a'\n" >> "$TEMP_ROOT/badging.mismatch"
expect_failure validate_release_metadata "$TEMP_ROOT/metadata.json" "$TEMP_ROOT/badging.mismatch" 2.8.4 com.peachpasswords app-arm64-v8a-release.apk arm64-v8a
expect_failure validate_release_metadata "$TEMP_ROOT/metadata.json" "$TEMP_ROOT/badging" 2.8.4 com.peachpasswords app-arm64-v8a-release.apk x86_64

# PB-26-132: the publish path must compare the APK's signer certificate against
# the configured release keystore's certificate, because aapt2 badging reports
# no signature at all.
if [ ! -x "${JAVA_HOME:-}/bin/keytool" ]; then
    for candidate in \
        /opt/homebrew/opt/openjdk@17 \
        /opt/homebrew/opt/openjdk@17/libexec/openjdk.jdk/Contents/Home
    do
        if [ -x "$candidate/bin/keytool" ]; then
            JAVA_HOME="$candidate"
            export JAVA_HOME
            break
        fi
    done
fi
[ -x "${JAVA_HOME:-}/bin/keytool" ] ||
    fail "keytool not found; set JAVA_HOME to exercise the signing-identity helpers"

"$JAVA_HOME/bin/keytool" -genkeypair -alias peachtest -keyalg RSA -keysize 2048 \
    -dname "CN=Peach Test" -validity 2 -keystore "$TEMP_ROOT/test.p12" \
    -storetype PKCS12 -storepass testpass -keypass testpass >/dev/null 2>&1

keystore_digest=$(release_certificate_sha256 "$TEMP_ROOT/test.p12" testpass peachtest)
[ "${#keystore_digest}" -eq 64 ] ||
    fail "keystore certificate digest was not extracted: '$keystore_digest'"

cat > "$TEMP_ROOT/apksigner" <<EOF
#!/bin/sh
printf 'Signer #1 certificate DN: CN=Peach Test\n'
printf 'Signer #1 certificate SHA-256 digest: $keystore_digest\n'
printf 'Signer #1 certificate SHA-1 digest: aa:bb:cc\n'
EOF
chmod +x "$TEMP_ROOT/apksigner"

apk_digest=$(apk_signer_sha256 "$TEMP_ROOT/apksigner" "$TEMP_ROOT/ignored.apk")
[ "$apk_digest" = "$keystore_digest" ] ||
    fail "APK signer digest was not extracted: '$apk_digest'"

assert_release_signer_matches "$keystore_digest" "$apk_digest" "test.apk"
different_digest=$(printf 'ab%.0s' 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32)
expect_failure assert_release_signer_matches "$keystore_digest" "$different_digest" "test.apk"
expect_failure assert_release_signer_matches "" "$apk_digest" "test.apk"
expect_failure assert_release_signer_matches "$keystore_digest" "" "test.apk"
expect_failure assert_established_release_certificate "$keystore_digest"
assert_established_release_certificate "e10b975178f0bee7fb5a4802519da70ec2988b6ef7d8c9401fbbcff5a1137668"

printf 'PASS: stable tool selection, malformed/ambiguous metadata, semantic-version mismatch, and signing-identity gates\n'