#!/bin/sh
# Only run inside a disposable container with /pkg mounted read-only.
set -eu
[ "${BLUEBIRD_INSTALL_SMOKE:-}" = 1 ] && [ "$(id -u)" = 0 ] && [ -f /pkg/ARCH ] || { echo 'Only for the isolated deployment test container' >&2; exit 1; }
fixture_password=install-fixture-password
worker_pid=
trap 'if [ -n "$worker_pid" ]; then kill "$worker_pid" 2>/dev/null || :; wait "$worker_pid" 2>/dev/null || :; fi' EXIT

/pkg/bluebird validate-config --config /pkg/config.toml
[ ! -e /pkg/var ]
# Invalid site paths must fail before publishing configuration or credentials.
if BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --prefix /opt/rejected --url http://files.example.test/path --encrypt --no-start >/tmp/rejected.log 2>&1; then echo 'Invalid site path accepted' >&2; exit 1; fi
[ ! -e /opt/rejected ]
[ -z "$(find /opt -maxdepth 1 -name '.bluebird-install-*' -print)" ]
if [ "${1:-https}" = http ]; then
 BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --url http://files.example.test --encrypt --no-start
 grep -q '^listen = "127.0.0.1:8080"$' /opt/bluebird/config.toml
 grep -q '^secure_cookies = false$' /opt/bluebird/config.toml
 runuser -u bluebird -- /opt/bluebird/bluebird check --config /opt/bluebird/config.toml
 echo 'Public HTTP hostname without a port installed successfully'
 exit 0
fi

if [ "${1:-https}" = lan ]; then
 if BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --prefix /opt/rejected --url http://192.168.1.10 --lan-http --no-start >/tmp/rejected-no-port.log 2>&1; then echo 'Portless LAN HTTP accepted' >&2; exit 1; fi
 grep -q '内网HTTP地址须包含端口' /tmp/rejected-no-port.log
 if BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --prefix /opt/rejected --url http://192.168.1.10:8080 --no-start >/tmp/rejected-lan.log 2>&1; then echo 'LAN HTTP accepted without explicit flag' >&2; exit 1; fi
 BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --url http://192.168.1.10:8080 --lan-http --encrypt --no-start
 grep -q '^listen = "192.168.1.10:8080"$' /opt/bluebird/config.toml
 grep -q '^allow_lan_http = true$' /opt/bluebird/config.toml
 grep -q '^secure_cookies = false$' /opt/bluebird/config.toml
 echo 'LAN installation and explicit HTTP opt-in passed'
 exit 0
fi
# A failed password prompt/init leaves no final data directory or stale stage.
if BLUEBIRD_ADMIN_PASSWORD=short /pkg/install.sh --prefix /opt/rejected --url https://files.example.com --no-start >/tmp/rejected-password.log 2>&1; then echo 'Short password accepted' >&2; exit 1; fi
[ ! -e /opt/rejected ]
[ -z "$(find /opt -maxdepth 1 -name '.bluebird-install-*' -print)" ]
BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --prefix /opt/bluebird-fixture --lan-url http://127.0.0.1:18995 --access-url http://files.example.com --url https://files.example.com --encrypt --no-start
prefix=/opt/bluebird-fixture
[ "$(stat -c '%U:%G:%a' "$prefix")" = root:bluebird:750 ]
[ "$(stat -c '%U:%G:%a' "$prefix/bluebird")" = root:bluebird:750 ]
[ "$(stat -c '%U:%G:%a' "$prefix/config.toml")" = root:bluebird:640 ]
[ "$(stat -c '%U:%G:%a' "$prefix/var")" = bluebird:bluebird:700 ]
grep -q '^public_url = .*https://files.example.com' "$prefix/config.toml"
grep -q '^secure_cookies = true$' "$prefix/config.toml"
grep -q 'http://files.example.com' "$prefix/config.toml"
grep -q 'http://127.0.0.1:18995' "$prefix/config.toml"
grep -q '^allow_lan_http = true$' "$prefix/config.toml"
grep -q '^encryption = true$' "$prefix/config.toml"
grep -q "^ExecStart=$prefix/bluebird serve --config $prefix/config.toml$" /etc/systemd/system/bluebird.service
[ -f "$prefix/var/secrets/age.key" ]
if grep -raq "$fixture_password" "$prefix"; then echo 'Plaintext bootstrap password persisted' >&2; exit 1; fi
before=$(sha256sum "$prefix/config.toml")
if BLUEBIRD_ADMIN_PASSWORD=another-password /pkg/install.sh --prefix "$prefix" --url https://other.example.com --no-start >/tmp/reinstall.log 2>&1; then echo 'Existing installation overwritten' >&2; exit 1; fi
[ "$(sha256sum "$prefix/config.toml")" = "$before" ]
runuser -u bluebird -- "$prefix/bluebird" check --config "$prefix/config.toml"
runuser -u bluebird -- "$prefix/bluebird" serve --config "$prefix/config.toml" >/tmp/bluebird-serve.log 2>&1 &
worker_pid=$!
ready=false
for attempt in 1 2 3 4 5 6 7 8 9 10; do
 if bash -c 'exec 3<>/dev/tcp/127.0.0.1/18995; printf "GET /api/v1/health HTTP/1.1\r\nHost: files.example.com\r\nConnection: close\r\n\r\n" >&3; cat <&3' >/tmp/health.txt 2>/dev/null && grep -q '"ready":true' /tmp/health.txt; then ready=true; break; fi
 sleep .1
done
[ "$ready" = true ] || { cat /tmp/bluebird-serve.log; exit 1; }
# Config validation is read-only and may run while the service holds its lock.
runuser -u bluebird -- "$prefix/bluebird" validate-config --config "$prefix/config.toml"
if runuser -u bluebird -- "$prefix/bluebird" check --config "$prefix/config.toml" >/tmp/locked-check.log 2>&1; then echo 'Maintenance ignored service lock' >&2; exit 1; fi
kill "$worker_pid"
wait "$worker_pid" || :
worker_pid=
echo 'Installation, ownership, protected credentials, repeat-install guard and native service passed'