#!/bin/bash
set -uo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

python3 - "$ROOT" <<'PY'
import json
import re
import sys
from pathlib import Path

root = Path(sys.argv[1])
control = (root / "packaging/debian/control.template").read_text()
postinst = (root / "packaging/debian/postinst").read_text()
provision = (root / "scripts/classroom-provision").read_text()
units = "\n".join(path.read_text() for path in (root / "systemd").rglob("*.service"))
canary = (root / "update_canary.sh").read_text()
validation_script = (root / "tools/validate-trixie-release.sh").read_text()
sway = (root / "config/sway/config").read_text()
build = (root / "tools/build-release.sh").read_text()
policy = json.loads(
    (root / "config/chrome/policies/managed/ekklesia-classroom.json").read_text()
)

passed = failed = 0


def check(label, condition):
    global passed, failed
    if condition:
        print(f"  ok   {label}")
        passed += 1
    else:
        print(f"  FAIL {label}")
        failed += 1


depends = re.search(r"^Depends: (.*)$", control, re.MULTILINE).group(1).split(", ")

print("1. Trixie package contract")
for package in (
    "network-manager",
    "cups",
    "cups-client",
    "cups-filters",
    "foomatic-db-compressed-ppds",
):
    check(f"depends on {package}", package in depends)

print()
print("2. networking service behavior")
check("NetworkManager is explicitly enabled", "systemctl enable NetworkManager.service || true" in postinst)
check("NetworkManager start is best effort", "systemctl start NetworkManager.service || true" in postinst)
check("online waiter is disabled", "systemctl disable NetworkManager-wait-online.service || true" in postinst)
check("no classroom NetworkManager config overrides ifupdown", not (root / "config/network").exists())

print()
print("3. printing service behavior")
check("CUPS service and socket are enabled", "systemctl enable cups.socket cups.service || true" in postinst)
check("CUPS start is best effort", "systemctl start cups.socket || true" in postinst)
check("automatic remote queue browsing is disabled", "systemctl disable --now cups-browsed.service || true" in postinst)
check("Avahi service and socket are disabled", "systemctl disable --now avahi-daemon.socket avahi-daemon.service || true" in postinst)
check("Avahi service and socket are masked", "systemctl mask avahi-daemon.socket avahi-daemon.service || true" in postinst)
check("printer setup is not a blocking boot dependency", "classroom-printer-setup" not in units)
check("printer setup runs automatically in provisioning", "/usr/local/bin/classroom-printer-setup" in provision)
check("printer provisioning is bounded", "--kill-after=5s 30s" in provision)
check("Chrome uses the system print dialog", policy.get("DisablePrintPreview") is True)

print()
print("4. secondary Chrome windows")
check("stateful Chrome helper starts with Sway", "/usr/local/bin/classroom-chrome-windows" in sway)
check("Chrome helper is packaged", '"$ROOT/scripts/classroom-chrome-windows"' in build)
check("Chrome role module is packaged", '"$ROOT/lib/classroom_chrome.py"' in build)
check("no broad Chrome floating rule", not any(
    "google-chrome" in line and "floating enable" in line
    for line in sway.splitlines()
))

print()
print("5. bounded Trixie validation")
check("container has an outer deadline", "720s" in validation_script)
check("package installs have deadlines", "candidate-install 360" in validation_script)
check("container service startup is suppressed", "/usr/sbin/policy-rc.d" in validation_script and "exit 101" in validation_script)

print()
print("6. canary release gate")
validation = canary.index('"$ROOT/tools/validate-trixie-release.sh"')
package_copy = canary.index('cp "$package_path"')
first_rsync = canary.index("rsync -av")
check("Trixie validation runs before the repository copy", validation < package_copy)
check("Trixie validation runs before any upload", validation < first_rsync)

print()
print(f"passed: {passed}  failed: {failed}")
raise SystemExit(1 if failed else 0)
PY