#!/usr/bin/env bash
set -euo pipefail
R=$(cd -- "$(dirname -- "$0")/.." && pwd)
mkdir -p "$R/.validation"
T=$(mktemp -d "$R/.validation/gitea-drone.XXXXXX")
umask 077
cleanup() {
    podman rm -f nd-validation-drone nd-validation-gitea >/dev/null 2>&1 || true
}
trap cleanup EXIT
for spec in 'docker.io/gitea/gitea:1.22 gitea-1.22-linux-amd64.tar' 'docker.io/drone/drone:2.24.0 drone-server-2.24.0-amd64.tar'; do
    read -r tag file <<<"$spec"
    podman image inspect "$tag" >/dev/null 2>&1 || podman load -i "$R/images/$file"
done
podman run -d --pull=never --name nd-validation-gitea --network host -e GITEA__server__HTTP_ADDR=127.0.0.1 -e GITEA__server__HTTP_PORT=23000 -e GITEA__server__ROOT_URL=http://localhost:23000/ -e GITEA__server__DISABLE_SSH=true -e GITEA__security__INSTALL_LOCK=true -e GITEA__service__DISABLE_REGISTRATION=true docker.io/gitea/gitea:1.22
for ((i = 0; i < 60; i++)); do
    curl -fsS --max-time 2 http://localhost:23000/api/healthz >/dev/null 2>&1 && break
    sleep 1
done
PASSWORD=$(python3 -c 'import secrets; print(secrets.token_hex(24))')
podman exec --user git nd-validation-gitea gitea admin user create --config /data/gitea/conf/app.ini --username validation --password "$PASSWORD" --email validation@localhost.invalid --admin --must-change-password=false >/dev/null
export PASSWORD T
python3 - <<'PY'
import base64
import json
import os
import secrets
import urllib.request
from pathlib import Path

base = "http://localhost:23000/api/v1"
auth = (
    "Basic "
    + base64.b64encode(("validation:" + os.environ["PASSWORD"]).encode()).decode()
)


def post(path, obj):
    with urllib.request.urlopen(
        urllib.request.Request(
            base + path,
            json.dumps(obj).encode(),
            {"Authorization": auth, "Content-Type": "application/json"},
        )
    ) as r:
        return json.load(r)


x = post(
    "/user/applications/oauth2",
    {
        "name": "Validation",
        "redirect_uris": ["http://localhost:28085/login"],
        "confidential_client": True,
    },
)
post("/user/repos", {"name": "my-app", "private": True, "auto_init": False})
token = post(
    "/users/validation/tokens", {"name": "clone-read", "scopes": ["read:repository"]}
)["sha1"]
with urllib.request.urlopen(
    urllib.request.Request(
        base + "/repos/validation/my-app", headers={"Authorization": "token " + token}
    )
) as r:
    assert r.status == 200
values = {
    "DRONE_SERVER_HOST": "localhost:28085",
    "DRONE_SERVER_PROTO": "http",
    "DRONE_SERVER_PORT": "127.0.0.1:28085",
    "DRONE_GITEA_SERVER": "http://localhost:23000",
    "DRONE_GITEA_CLIENT_ID": x["client_id"],
    "DRONE_GITEA_CLIENT_SECRET": x["client_secret"],
    "DRONE_RPC_SECRET": secrets.token_hex(24),
    "DRONE_USER_CREATE": "username:validation,admin:true",
    "DRONE_REGISTRATION_CLOSED": "true",
    "DRONE_DATADOG_ENABLED": "false",
}
(Path(os.environ["T"]) / "drone.env").write_text(
    "".join(k + "=" + v + "\n" for k, v in values.items())
)
PY
podman run -d --pull=never --name nd-validation-drone --network host --env-file "$T/drone.env" docker.io/drone/drone:2.24.0
ready=false
for ((i = 0; i < 60; i++)); do
    if curl -fsS --max-time 2 http://localhost:28085/healthz >/dev/null; then
        ready=true
        break
    fi
    sleep 1
done
[[ $ready == true ]]
echo 'PASS: Gitea bootstrap, private repository read token, OAuth creation, and Drone loopback health.'