#!/usr/bin/env bash
set -Eeuo pipefail
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
WORK=$(mktemp -d)
trap 'rm -rf "$WORK"' EXIT
mkdir -p "$WORK/source"
printf '#!/bin/sh\nexit 0\n' > "$WORK/rust-proxy"
chmod 0755 "$WORK/rust-proxy"

export BUILDER_ROOT="$ROOT" PACKAGE_NAME=rustproxy BINARY_NAME=rust-proxy
export VERSION=1.0.0 PACKAGE_RELEASE=1 DESCRIPTION=RustProxy LICENSE=UNKNOWN
export MAINTAINER=test@example.invalid HOMEPAGE=https://example.invalid
export GPG_PRIVATE_KEY_FILE=/nonexistent/test.gpg

check_unit() {
    local unit=$1
    # A read-only home does not conceal /home, unlike ProtectHome=true/tmpfs.
    [[ $(grep -c '^ProtectHome=read-only$' "$unit") -eq 1 ]]
    ! grep -Eq '^ProtectHome=(true|yes|tmpfs|false|no)$' "$unit"
    grep -Fxq 'ProtectSystem=strict' "$unit"
    grep -Fxq 'User=rustproxy' "$unit"
    grep -Fxq 'Group=rustproxy' "$unit"
    grep -Fxq 'NoNewPrivileges=true' "$unit"
    grep -Fxq 'CapabilityBoundingSet=CAP_NET_BIND_SERVICE' "$unit"
    grep -Fq 'ReadWritePaths=-/etc/rustproxy' "$unit"
    grep -Fxq 'ExecReload=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload' "$unit"
}

# Current RustProxy archive has no debian unit; both nFPM targets use fallback.
"$ROOT/scripts/prepare-package.sh" "$WORK/source" "$WORK/fallback" "$WORK/rust-proxy"
check_unit "$WORK/fallback/payload/usr/lib/systemd/system/rustproxy.service"
for platform in deb rpm; do
    grep -Fq '/usr/lib/systemd/system/rustproxy.service' "$WORK/fallback/nfpm-$platform.yaml"
    grep -Fq '/usr/share/doc/rustproxy/FILESYSTEM_ACCESS.md' "$WORK/fallback/nfpm-$platform.yaml"
done
cmp "$ROOT/packaging/rustproxy-filesystem-access.md" \
    "$WORK/fallback/payload/usr/share/doc/rustproxy/FILESYSTEM_ACCESS.md"

# Some source releases ship their own unit. Normalize its outdated home policy
# rather than letting it override the new package default.
mkdir -p "$WORK/source/debian"
cat > "$WORK/source/debian/rustproxy.service" <<'UNIT'
[Unit]
Description=RustProxy unit supplied with a source release

[Service]
User=rustproxy
Group=rustproxy
ExecStart=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy serve
ProtectSystem=strict
ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
ProtectHome=true
NoNewPrivileges=true
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target
UNIT
python3 "$ROOT/scripts/normalize-systemd-unit.py" "$WORK/source/debian/rustproxy.service" rust-proxy
check_unit "$WORK/source/debian/rustproxy.service"

# A custom unit without ProtectHome must also get the new safe policy.
sed -i '/^ProtectHome=/d' "$WORK/source/debian/rustproxy.service"
python3 "$ROOT/scripts/normalize-systemd-unit.py" "$WORK/source/debian/rustproxy.service" rust-proxy
check_unit "$WORK/source/debian/rustproxy.service"

echo 'Linux DEB/RPM external path access policy: OK'