#!/bin/sh
set -eu

fail() {
  printf 'Eden runtime audit failed: %s\n' "$1" >&2
  exit 1
}

for command in eden Xwayland nginx python3 xdotool findmnt ss pgrep; do
  command -v "$command" >/dev/null 2>&1 || fail "required command is absent: $command"
done

for command in docker dockerd containerd gcc g++ make cmake git ssh curl cron crond; do
  command -v "$command" >/dev/null 2>&1 && fail "unused privileged/development command is present: $command"
done

for process in eden Xwayland nginx python3 selkies; do
  pgrep -f "$process" >/dev/null 2>&1 || fail "required process is not running: $process"
done

for process in dockerd containerd cron crond sshd; do
  pgrep -x "$process" >/dev/null 2>&1 && fail "unused service is running: $process"
done

mount_options="$(findmnt -n -o OPTIONS --target /games)"
case ",$mount_options," in
  *,ro,*) ;;
  *) fail "/games is not mounted read-only" ;;
esac

[ -z "${DEV_MODE+x}" ] || fail "PixelFlux development mode must remain disabled"
if env | grep -Eiq '^(http|https|all|no)_proxy=|^netrc='; then
  fail "proxy or netrc environment can expose unused libcurl credential paths"
fi
if find /config /root -xdev -name .netrc -print -quit 2>/dev/null | grep -q .; then
  fail "a runtime .netrc file is present"
fi
if grep -RIEq '^[[:space:]]*map[[:space:]]' /etc/nginx /defaults 2>/dev/null; then
  fail "nginx map directives are forbidden in the isolated player"
fi

xwayland="$(pgrep -a -x Xwayland | head -1)"
printf '%s' "$xwayland" | grep -Fq -- '-rootless' || fail "Xwayland is not rootless"
printf '%s' "$xwayland" | grep -Eq -- '-listen[[:space:]]+tcp' && fail "Xwayland TCP listening is enabled"
ss -lnt | awk 'NR > 1 { print $4 }' | grep -Eq '(^|:):?60[0-9][0-9]$' && fail "an X11 TCP port is listening"

if find /config -xdev -type f \( -iname '*.svg' -o -iname '*.dtd' \) -print -quit 2>/dev/null | grep -q .; then
  fail "untrusted SVG or DTD input is present in app-owned runtime configuration"
fi
if find /config -xdev -type f -size -1M -exec grep -Il 'rist://' {} + 2>/dev/null | grep -q .; then
  fail "a RIST media URL is present in runtime configuration"
fi
env | grep -Eiq 'rist://' && fail "a RIST media URL is present in the environment"

printf 'Eden runtime audit passed: minimal tools, read-only games, bounded local display and no vulnerable optional protocol configuration.\n'