#!/bin/sh
set -eu

repo="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
profile="${1:-full}"
case "$profile" in
  source|test|lint|typecheck|build|security|full) ;;
  *) echo "validation profile is not allowlisted: $profile" >&2; exit 2 ;;
esac

cd "$repo"
git_worktree=false
if [ -n "${WSL_INTEROP:-}" ] && command -v git.exe >/dev/null 2>&1; then
  dotnet_command=dotnet.exe
  python_command=python.exe
  docker_command=docker.exe
  default_release_cache="/var/tmp/ludarium-release-tools"
  npm_run() { cmd.exe /d /c npm "$@"; }
  repo_windows="$(wslpath -w "$repo")"
  if git.exe -C "$repo_windows" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
    git.exe -C "$repo_windows" diff --check
    if git.exe -C "$repo_windows" grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
      echo "unresolved merge markers detected" >&2
      exit 1
    fi
    git_worktree=true
  fi
else
  dotnet_command=dotnet
  if command -v python3 >/dev/null 2>&1; then python_command=python3; else python_command=python; fi
  docker_command=docker
  default_release_cache="${RUNNER_TEMP:-/tmp}/ludarium-release-tools"
  npm_run() { npm "$@"; }
  if git -C "$repo" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
    git -C "$repo" diff --check
    if git -C "$repo" grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
      echo "unresolved merge markers detected" >&2
      exit 1
    fi
    git_worktree=true
  fi
fi
if [ "$git_worktree" = false ]; then
  if grep -RInI -E '^(<<<<<<< |=======$|>>>>>>> )' \
      --exclude='*.lock' --exclude='*.patch' .; then
    echo "unresolved merge markers detected" >&2
    exit 1
  fi
fi
sh deploy/verify-release-identity.sh

case "$profile" in
  source|test|lint|build|full)
    "$dotnet_command" restore Ludarium.slnx --locked-mode
    ;;
esac
case "$profile" in
  source|lint|full)
    "$dotnet_command" format Ludarium.slnx --verify-no-changes --no-restore
    ;;
esac
case "$profile" in
  source|build|full)
    "$dotnet_command" build Ludarium.slnx --configuration Release --no-restore
    ;;
esac
case "$profile" in
  test)
    "$dotnet_command" test Ludarium.slnx --configuration Release --no-restore
    ;;
  source|full)
    "$dotnet_command" test Ludarium.slnx --configuration Release --no-build --no-restore
    ;;
esac

case "$profile" in
  source|test|typecheck|build|security|full)
    npm_run ci --ignore-scripts --prefix src/Ludarium.Web
    ;;
esac
case "$profile" in
  source|test|full)
    npm_run run test --prefix src/Ludarium.Web
    ;;
esac
case "$profile" in
  typecheck)
    npm_run run typecheck --prefix src/Ludarium.Web
    ;;
  source|build|full)
    npm_run run build --prefix src/Ludarium.Web
    ;;
esac
case "$profile" in
  source|security|full)
    npm_run audit --audit-level=high --prefix src/Ludarium.Web
    ;;
esac

case "$profile" in
  source|test|full)
    "$python_command" -m unittest discover -s tests/controllers -t tests/controllers
    ;;
esac

case "$profile" in
  security|full)
    release="$(tr -d '\r\n' < VERSION)"
    image="${LUDARIUM_IMAGE:-ludarium/ludarium:validation-${GITHUB_SHA:-$release}}"
    build_network="${LUDARIUM_DOCKER_BUILD_NETWORK:-default}"
    emulatorjs_asset=""
    cleanup_build_inputs() {
      [ -z "$emulatorjs_asset" ] || rm -f "$emulatorjs_asset" "${emulatorjs_asset}.part"
    }
    trap cleanup_build_inputs EXIT HUP INT TERM
    case "$build_network" in
      default) "$docker_command" build --pull --file Dockerfile.unraid --tag "$image" . ;;
      host)
        emulatorjs_version=4.2.3
        emulatorjs_sha256=07d451bc06fa3ad04ab30d9b94eb63ac34ad0babee52d60357b002bde8f3850b
        emulatorjs_asset="$repo/.build-inputs/emulatorjs/$emulatorjs_version.7z"
        mkdir -p "$(dirname "$emulatorjs_asset")"
        if [ ! -f "$emulatorjs_asset" ] || ! printf '%s  %s\n' "$emulatorjs_sha256" "$emulatorjs_asset" | sha256sum -c - >/dev/null 2>&1; then
          rm -f "$emulatorjs_asset" "${emulatorjs_asset}.part"
          download_attempt=1
          while ! "$docker_command" run --rm --dns 1.1.1.1 --dns 8.8.8.8 alpine:3.23@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40 \
              wget -q -T 60 "https://github.com/EmulatorJS/EmulatorJS/releases/download/v$emulatorjs_version/$emulatorjs_version.7z" -O - \
              > "${emulatorjs_asset}.part"; do
            rm -f "${emulatorjs_asset}.part"
            [ "$download_attempt" -lt 3 ] || exit 1
            sleep "$download_attempt"
            download_attempt=$((download_attempt + 1))
          done
          printf '%s  %s\n' "$emulatorjs_sha256" "${emulatorjs_asset}.part" | sha256sum -c - >/dev/null
          mv "${emulatorjs_asset}.part" "$emulatorjs_asset"
        fi
        "$docker_command" build --network host --pull --file Dockerfile.unraid --tag "$image" .
        ;;
      *) echo "docker build network is not allowlisted: $build_network" >&2; exit 2 ;;
    esac
    cleanup_build_inputs
    trap - EXIT HUP INT TERM
      LUDARIUM_IMAGE="$image" \
      LUDARIUM_RELEASE_VERSION="${GITHUB_SHA:-$release}" \
      LUDARIUM_RELEASE_TOOL_CACHE="${LUDARIUM_RELEASE_TOOL_CACHE:-$default_release_cache}" \
      sh deploy/run-security-gates.sh
    ;;
esac

printf 'managed validation passed: %s\n' "$profile"