#!/usr/bin/env sh
# Exercise the wrapper without a Docker daemon or any firewall operation.
set -eu
wrapper="$(pwd)/scripts/ci/linux-agent-container-smoke.sh"
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
mkdir "$tmp/bin"
cat >"$tmp/bin/docker" <<'DOCKER'
#!/usr/bin/env sh
set -eu
printf '%s\n' "$*" >>"$FAKE_LOG"
case "$1" in
  info)
    case "$*" in
      *SecurityOptions*) if [ "$FAKE_APPARMOR" = true ]; then printf '["name=apparmor","name=seccomp,profile=default"]\n'; else printf '["name=seccomp,profile=default"]\n'; fi ;;
      *) printf 'linux\n' ;;
    esac ;;
  build)
    while [ "$#" -gt 0 ]; do
      if [ "$1" = --iidfile ]; then shift; printf 'sha256:%064d\n' 0 >"$1"; break; fi
      shift
    done ;;
  run) exit "$FAKE_RUN_EXIT" ;;
  rm|image) exit 0 ;;
  *) exit 98 ;;
esac
DOCKER
chmod +x "$tmp/bin/docker"
for expected in 0 23; do
  log="$tmp/docker-$expected.log"
  apparmor=false; [ "$expected" = 0 ] || apparmor=true
  if PATH="$tmp/bin:$PATH" FAKE_LOG="$log" FAKE_APPARMOR="$apparmor" FAKE_RUN_EXIT="$expected" sh "$wrapper"; then actual=0; else actual=$?; fi
  [ "$actual" = "$expected" ] || { echo 'Wrapper did not preserve the container exit code' >&2; exit 1; }
  grep -F 'build --file scripts/ci/linux-agent-smoke.Dockerfile --iidfile ' "$log" >/dev/null
  grep -F ' --network none --cap-drop ALL --cap-add SYS_ADMIN --cap-add NET_ADMIN --cap-add NET_RAW ' "$log" >/dev/null
  capabilities="$(grep '^run ' "$log" | awk '{ for (i=1; i<=NF; i++) if ($i == "--cap-add") print $(i+1) }' | sort | tr '\n' ' ')"
  [ "$capabilities" = 'NET_ADMIN NET_RAW SYS_ADMIN ' ] || { echo 'Unexpected helper capability set' >&2; exit 1; }
  grep -F ' --security-opt no-new-privileges:true --read-only --tmpfs /tmp:' "$log" >/dev/null
  grep -F 'image rm sha256:' "$log" >/dev/null
  grep -E '^rm -f evofw-linux-smoke-' "$log" >/dev/null
  if grep -E -- '(--privileged|--network host|--pid host|--mount|--volume|docker.sock|seccomp=)' "$log" >/dev/null; then echo 'Unsafe helper isolation flags' >&2; exit 1; fi
  if [ "$apparmor" = true ]; then grep -F ' --security-opt apparmor=unconfined ' "$log" >/dev/null
  elif grep -F 'apparmor=unconfined' "$log" >/dev/null; then echo 'Unneeded AppArmor exception' >&2; exit 1
  fi
done
echo 'Helper wrapper regression passed (flags, remote context, exit status, cleanup)'