#!/usr/bin/env bash
# Proves the tests can fail. Each control copies the repository, breaks one guard on
# purpose and runs the test that covers it: the run passes only if the test passes on
# the untouched copy AND fails on the broken one. Nothing in this checkout is changed.
#   scripts/positive-controls.sh             JS guards (seconds, no network)
#   scripts/positive-controls.sh --network   also tamper with the mainnet evidence
#   scripts/positive-controls.sh --rust      also break the contract's fingerprint check
set -euo pipefail
cd "$(dirname "$0")/.."
ROOT=$PWD
NETWORK=0; RUST=0
for a in "$@"; do
  case "$a" in --network) NETWORK=1 ;; --rust) RUST=1 ;; *) echo "unknown option $a"; exit 2 ;; esac
done

WORK=$(mktemp -d "${TMPDIR:-/tmp}/duly-controls.XXXXXX")
trap 'rm -rf -- "$WORK"' EXIT
ran=0; bad=0

copy() {
  rm -rf -- "$WORK/repo"; mkdir -p "$WORK/repo"
  (cd "$ROOT" && tar cf - --exclude=./target --exclude=./node_modules --exclude=./.git --exclude=./docs .) | (cd "$WORK/repo" && tar xf -)
}

# break FILE OLD NEW: replace an exact string once, and refuse if it is not there.
break_it() {
  python3 -I - "$WORK/repo/$1" "$2" "$3" <<'PY'
import sys
path, old, new = sys.argv[1:4]
s = open(path).read()
if s.count(old) != 1:
    sys.exit(f"control could not be applied: {old!r} found {s.count(old)} times in {path}")
open(path, "w").write(s.replace(old, new))
PY
}

control() { # NAME FILE OLD NEW -- COMMAND...
  local name=$1 file=$2 old=$3 new=$4; shift 5
  ran=$((ran + 1))
  copy
  if ! (cd "$WORK/repo" && "$@") >"$WORK/clean.log" 2>&1; then
    echo "  FAIL  $name: the test fails even before the guard is broken"; tail -5 "$WORK/clean.log"; bad=$((bad + 1)); return
  fi
  break_it "$file" "$old" "$new"
  if (cd "$WORK/repo" && "$@") >"$WORK/broken.log" 2>&1; then
    echo "  FAIL  $name: the test still passes with the guard broken"; bad=$((bad + 1))
  else
    echo "  PASS  $name: passes intact, fails when broken"
  fi
}

echo "Positive controls: each guard is broken on purpose in a copy, and its test must catch it"

control "relayer allowlist: sponsoring ft_transfer on top of the list" \
  worker/src/policy.js "export const METHODS = {" "export const METHODS = {
  ft_transfer: { gas: 30n * TGAS, deposit: 1n, exact: true, perDay: 20 }," -- \
  node --test test/policy.test.mjs

control "relayer allowlist: sponsoring calls to any contract" \
  worker/src/policy.js "if (delegate.receiverId !== contract)" "if (false && delegate.receiverId !== contract)" -- \
  node --test test/policy.test.mjs

control "relayer deposit pin: letting a call attach more NEAR than its method needs" \
  worker/src/policy.js "if (rule.exact ? action.deposit !== rule.deposit : action.deposit > rule.deposit) {" "if (false) {" -- \
  node --test test/policy.test.mjs

control "line-item fingerprint: opening a document without comparing it to the chain" \
  web/lib/doc.js "if (expectedHash && hex(await sha256(sealed)) !== expectedHash) {" "if (false) {" -- \
  node --test test/doc.test.mjs

control "first paint: a page that says Loading instead of the evidence" \
  worker/src/pages.js "<h2>Proof on NEAR mainnet</h2>" "<h2>Loading</h2>" -- \
  node --test test/pages.test.mjs

if [ "$NETWORK" = 1 ]; then
  control "mainnet evidence: claiming 0.30 USDC was set aside on invoice 1-3 instead of 0.20" \
    evidence/mainnet.js "{ id: '1-3', amount: '1000000', paid: '1000000', setAside: '200000'" "{ id: '1-3', amount: '1000000', paid: '1000000', setAside: '300000'" -- \
    node scripts/verify-mainnet.mjs
  control "mainnet evidence: a Base payment of 2.00 USDC instead of 1.00221" \
    evidence/mainnet.js "amount: '1002210'" "amount: '2000000'" -- \
    node scripts/verify-mainnet.mjs
fi

if [ "$RUST" = 1 ]; then
  # Its own build directory: cargo records paths relative to the workspace, so a shared
  # one would hand the broken build to the next `cargo test` in the real checkout.
  export CARGO_TARGET_DIR="$WORK/target"
  control "contract fingerprint: accepting a document hash that is not 64 lowercase hex" \
    contract/src/lib.rs "b'a'..=b'f' => Some(c - b'a' + 10)," "b'a'..=b'f' => Some(c - b'a' + 10),
        b'A'..=b'F' => Some(c - b'A' + 10)," -- \
    cargo test -p duly-contract --locked document_fingerprint
fi

if [ "$ran" = 0 ]; then echo "No controls ran. That is a failure."; exit 1; fi
if [ "$bad" -gt 0 ]; then echo "$bad of $ran controls FAILED."; exit 1; fi
echo "All $ran controls passed: every guard above is covered by a test that fails without it."