#!/bin/sh
# Hermetic negative-path tests for the native-library provenance allow-list.
# No Android SDK, Gradle, or built APK is required.
set -eu

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
CHECK="$SCRIPT_DIR/check-native-provenance.py"
TEMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/peach-native-provenance-tests.XXXXXX")
trap 'trash "$TEMP_ROOT"' EXIT HUP INT TERM

cp -R "$ROOT/docs/." "$TEMP_ROOT/docs"
mkdir -p "$TEMP_ROOT/scripts"
mkdir -p "$TEMP_ROOT/app/src/main/jniLibs/arm64-v8a" "$TEMP_ROOT/app/src/main/jniLibs/x86_64"
cp "$ROOT/app/src/main/jniLibs/arm64-v8a/libpeach_noise_core.so" "$TEMP_ROOT/app/src/main/jniLibs/arm64-v8a/"
cp "$ROOT/app/src/main/jniLibs/x86_64/libpeach_noise_core.so" "$TEMP_ROOT/app/src/main/jniLibs/x86_64/"
# The checker resolves the repository root as its own parent's parent, so it has
# to sit in a `scripts/` directory of the temporary tree, not at its root.
cp "$CHECK" "$TEMP_ROOT/scripts/check-native-provenance.py"

# Positive control: the genuine tree passes.
python3 "$TEMP_ROOT/scripts/check-native-provenance.py" || exit 1

# An unrecorded library in the source set is refused even though every recorded
# digest still matches (PB-26-123): the inventory is an allow-list.
: > "$TEMP_ROOT/app/src/main/jniLibs/arm64-v8a/libextra.so"
if python3 "$TEMP_ROOT/scripts/check-native-provenance.py" >/dev/null 2>&1; then
    echo "FAIL: an unrecorded native library was accepted" >&2
    exit 1
fi
trash "$TEMP_ROOT/app/src/main/jniLibs/arm64-v8a/libextra.so"
python3 "$TEMP_ROOT/scripts/check-native-provenance.py" || exit 1

# A library that reached the artifact only through a dependency never appears
# under jniLibs, so the packaged APK is checked directly. Here the recorded set
# is present and correct; only the extra entry must refuse.
python3 - "$TEMP_ROOT/fake.apk" \
    "$TEMP_ROOT/app/src/main/jniLibs/arm64-v8a/libpeach_noise_core.so" <<'PY'
import sys, zipfile
apk, noise_core = sys.argv[1], sys.argv[2]
with open(noise_core, "rb") as stream:
    payload = stream.read()
with zipfile.ZipFile(apk, "w") as archive:
    archive.writestr("lib/arm64-v8a/libpeach_noise_core.so", payload)
    archive.writestr("lib/arm64-v8a/libdependency.so", b"unreviewed")
PY
if python3 "$TEMP_ROOT/scripts/check-native-provenance.py" "$TEMP_ROOT/fake.apk" >/dev/null 2>&1; then
    echo "FAIL: an unrecorded packaged native library was accepted" >&2
    exit 1
fi

# A recorded library whose bytes changed is refused.
printf '\n' >> "$TEMP_ROOT/app/src/main/jniLibs/arm64-v8a/libpeach_noise_core.so"
if python3 "$TEMP_ROOT/scripts/check-native-provenance.py" >/dev/null 2>&1; then
    echo "FAIL: mutated native library was accepted" >&2
    exit 1
fi

printf 'PASS: native provenance allow-list and drift gate\n'