#!/usr/bin/env bash
# verify.sh — read-only drift detection (§5.3, §5.8).
#
# Runs as the operator account, never root: almost everything here is
# user-scoped, and as root it would read root's configuration and report
# confidently on the wrong user.
#
# Reports PASS / FAIL / SKIP. Only one assertion may SKIP; every other one
# that cannot run is a FAIL. A run that skipped everything must NOT look
# healthy — that is the cheapest possible way to disable this whole layer.

set -uo pipefail
cd "$(dirname "$0")" || exit 1

# This script is entered three ways — over ssh from phase_11_verify() (a
# non-login shell), from the verify systemd timer (no shell profile at all),
# and by hand — and the first two never reach the `mise activate` line at the
# end of ~/.bashrc: Ubuntu's ~/.bashrc returns on its first line when the
# shell is not interactive. mise, rustup, pnpm, claude and pass-cli all live
# behind that PATH, and so does the pnpm binary the store-dir check below
# shells out to. Set it explicitly instead of hoping an rc file does,
# matching the PATH job-wrapper.sh and 20-toolchains.sh's as_user() already
# build for the same reason (§13.2, environment).
export PATH="$HOME/.local/bin:$HOME/.local/share/mise/shims:$HOME/.cargo/bin:$HOME/.local/share/pnpm/bin:$PATH"

# shellcheck source=lib/common.sh
source lib/common.sh   # for vault_get, used by the backup-escrow section below;
                         # also sets FLIT_NAME and FLIT_USER
# shellcheck source=lib/jobs.sh
source lib/jobs.sh      # the committed table the timers section below loops over

: "${NO_EXTERNAL_STATE:=0}"   # set by drills; relaxes timer-enabled assertions
: "${FLIT_USER:=dev}"         # the operator account; bootstrap.sh passes this
                               # over ssh, and this is the fallback for runs
                               # triggered locally by the verify timer

P=0; F=0; S=0
declare -a FAILED=() SKIPPED=()

pass() { printf '  PASS  %s\n' "$1"; P=$((P+1)); }
fail() { printf '  FAIL  %s — %s\n' "$1" "${2:-}"; F=$((F+1)); FAILED+=("$1"); }
# skip() is deliberately available to only one call site (see §5.3).
skip() { printf '  SKIP  %s — %s\n' "$1" "${2:-}"; S=$((S+1)); SKIPPED+=("$1"); }

# check <name> <expected> <command...> — non-skippable by construction:
# if the command cannot run, that is a FAIL, not a SKIP.
check() {
  local name=$1 expected=$2; shift 2
  local actual
  if ! actual=$("$@" 2>&1); then
    fail "$name" "could not evaluate: ${actual:0:120}"
    return
  fi
  [[ "$actual" == "$expected" ]] && pass "$name" \
    || fail "$name" "expected '$expected', got '${actual:0:80}'"
}

check_true() {
  local name=$1; shift
  if "$@" >/dev/null 2>&1; then pass "$name"; else fail "$name" "command reported false"; fi
}

# tmux_conf_value <option> — the value the LAST `set -g <option> ...` line in
# ~/.tmux.conf would apply, found by reading the file rather than asking a
# live tmux server: `tmux show -gv` needs a running server, and a box nobody
# has logged into has none (§13.2, environment). A throwaway server was tried
# and rejected — tmux's own compiled-in defaults for set-clipboard
# ("external") and window-size ("latest") already match the values this
# deploys, so a server given no config at all reports the same value as one
# whose config sets it correctly, which is exactly the regression this check
# exists to catch. Reading the file is faithful because cfg_apply's managed
# block, written by 25-terminal.sh, is the only writer of these lines and
# always writes them in this form.
tmux_conf_value() {
  awk -v opt="$1" '$1 == "set" && $2 == "-g" && $3 == opt { val = $4 } END { print val }' \
    "$HOME/.tmux.conf"
}

# bashrc_export_value <VAR> — the value the LAST `export VAR=...` line in
# ~/.bashrc sets, read directly rather than through a shell: a systemd timer's
# environment has no shell profile at all, and even a login shell over ssh
# never reaches the export, because Ubuntu's ~/.bashrc returns on its first
# line when non-interactive (§13.2, environment). This reads the line
# 25-terminal.sh's managed block writes, not whatever happens to be exported
# into the shell running this check.
bashrc_export_value() {
  awk -v var="$1" '
    $0 ~ "^export " var "=" { val = $0; sub("^export " var "=", "", val) }
    END { print val }
  ' "$HOME/.bashrc"
}

# tangled_identified — does the forge recognise the key THIS box holds?
#
# Exit status cannot answer that. The knot accepts the connection and exits 0
# whether or not it knows the key, greeting an unregistered one with "Hi there!"
# and an instruction to publish it. So a check on the exit status passes with an
# unregistered key, with the wrong key, and with no key at all — it asserts only
# that tangled.org is reachable, while reading as proof that pushing works. The
# greeting is the only thing that distinguishes them, so the greeting is what
# this reads.
#
# IdentityAgent=none, not merely BatchMode: with an agent forwarded, ssh offers
# the agent's keys too, and this would pass on the operator's identity while the
# box's own key was missing or unregistered — proving the opposite of what it
# claims. ControlPath=none for the same reason a lockout check needs it: a
# multiplexed connection answers from a session opened with different
# credentials.
#
# The output is captured before being matched, never piped into a matcher: a
# pipeline ending in an early-exit consumer fails under pipefail and the failure
# is indistinguishable from the condition being asserted against (standing rule
# 13) — worst here, where the pipeline IS the assertion.
tangled_identified() {
  local out
  out=$(ssh -o BatchMode=yes -o IdentityAgent=none -o ControlPath=none \
           -T git@tangled.org 2>&1)
  case "$out" in
    *"You're authenticated"*) return 0 ;;
    *) return 1 ;;
  esac
}

echo "=== identity ==="
check "running as $FLIT_USER" "$FLIT_USER" id -un

echo "=== toolchain ==="
for c in tmux vim git rg fd jq restic curl mise rustup pnpm claude pass-cli tailscale; do
  check_true "present: $c" command -v "$c"
done

echo "=== claude config ==="
# chook.mjs resolves its rules to ~/.config/chook.toml and nowhere else, while
# the file is delivered as part of the ~/.claude payload. When the link is
# missing chook loads no rules, and the failure is silent in the way that costs
# most: the hooks stay wired in settings.json and still run on every tool call,
# so the guards return nothing and read as passing rather than as absent.
check "chook config resolves to the delivered file" "$HOME/.claude/chook.toml" \
  readlink -f "$HOME/.config/chook.toml"

# The rules being reachable says nothing about the interpreter being there. chook
# is a project checkout (§4.5), not part of the ~/.claude payload, so nothing in
# a provisioning run puts it on the box or notices that it is gone — a box that
# has never had laptop/push-project.sh run for it reaches steady state with every
# hook in settings.json naming a file that does not exist.
check_true "chook present at ~/workspace/chook" test -f "$HOME/workspace/chook/chook.mjs"

# And that it is a checkout rather than a copy. The archive this replaced left a
# tree with no .git, where an agent's work had nowhere to be committed and no way
# off the box; a copy landing here again would look identical to verify.sh's
# other assertions while restoring exactly that dead end.
check_true "chook is a git checkout, not a copy" test -e "$HOME/workspace/chook/.git"

# Per-project agent configuration lives in the delivered payload, one directory
# per project, and each project reaches it through a relative symlink created by
# laptop/adopt-project-config.sh. The link is what can break: rsync carries it
# verbatim, so a project pushed from a laptop where it was never adopted, or one
# whose directory was replaced by a real .claude, silently runs with different
# configuration than the laptop does.
#
# The subject list is derived from the delivered payload rather than written
# down here, so adopting a project needs no second edit and cannot drift from
# what was actually delivered (§13.2). Projects that are not on this box are not
# asserted — they are absent, not broken.
#
# This is structural only. It cannot see Claude Code dropping support for a
# symlinked .claude, which would leave every link resolving perfectly while the
# configuration behind it went unread; server/bin/check-project-config.sh is the
# behavioural check that catches that, and it is deliberately not run from here
# because it starts a real session.
echo "=== project config ==="
for cfg in "$HOME"/.claude/project-config/*/; do
  [[ -d "$cfg" ]] || continue          # no match: the glob stays literal
  # A directory holding no files is not an adopted project. rsync --delete
  # removes the files of an entry dropped from the payload but can leave its
  # directories behind, and asserting a link for one of those reports drift for
  # a project that was deliberately un-adopted.
  [[ -n "$(find "$cfg" -type f -print -quit 2>/dev/null)" ]] || continue
  pname=$(basename "$cfg")
  proj="$HOME/workspace/$pname"
  [[ -d "$proj" ]] || continue

  # A project that versions its own .claude is the other supported shape, not
  # drift: its configuration reaches both machines by the project's own git, and
  # the project-config entry simply goes unused here. The link assertion below
  # does not apply to it — but the two shapes must not coexist, because a
  # symlink laid over tracked files makes git report every one of them as
  # deleted while Claude Code goes on reading the link. From the link's side
  # that state is indistinguishable from a correct adoption, which is why it is
  # asserted here rather than left to the assertion below to pass happily.
  #
  # Trailing slash on the pathspec: it must match entries UNDER the directory,
  # where a bare `.claude` would also match an adopted symlink that was itself
  # committed.
  if [[ -n "$(git -C "$proj" ls-files -- '.claude/' 2>/dev/null | head -1)" ]]; then
    check_true "$pname versions its own .claude, unshadowed" test ! -L "$proj/.claude"
    continue
  fi

  check "project config linked: $pname" "$HOME/.claude/project-config/$pname" \
    bash -c 'cd "$1/.claude" 2>/dev/null && pwd -P' _ "$proj"
done

echo "=== locale (§4.3) ==="
check_true "UTF-8 locale active" bash -c '[[ "$(locale charmap)" == "UTF-8" ]]'

echo "=== timezone (§4.1) ==="
check "timezone is Europe/Berlin" "Europe/Berlin" timedatectl show -p Timezone --value

echo "=== tailscale (§4.2) ==="
check "tailscale backend running" "Running" \
  bash -c 'tailscale status --json | jq -r .BackendState'
# A node whose key expires becomes unreachable, and public SSH is closed.
# This is the one form of drift that cannot be fixed after the fact.
check_true "node key expiry disabled or >30d away" bash -c '
  exp=$(tailscale status --json | jq -r ".Self.KeyExpiry // empty")
  [[ -z "$exp" || "$exp" == "null" ]] && exit 0
  (( $(date -d "$exp" +%s) - $(date +%s) > 2592000 ))'

# Resets a booted-from-snapshot clone's stolen tailscale identity before
# tailscaled starts (§6.1). Installed by 30-tailscale.sh, enabled on every
# host regardless of NO_EXTERNAL_STATE — it costs nothing external to leave on.
GUARD_UNIT="${FLIT_NAME}-tailscale-clone-guard.service"
check_true "unit loaded: $GUARD_UNIT" bash -c \
  "systemctl list-unit-files '$GUARD_UNIT' --no-legend | grep -q ."
check "unit enabled: $GUARD_UNIT" "enabled" systemctl is-enabled "$GUARD_UNIT"

echo "=== terminal (§5.7) ==="
check "tmux set-clipboard is external" "external" tmux_conf_value set-clipboard
check "tmux allow-passthrough on"      "on"       tmux_conf_value allow-passthrough
check "tmux window-size latest"        "latest"   tmux_conf_value window-size
check "Claude Code classic renderer forced" "1" \
  bashrc_export_value CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN

echo "=== pnpm invariant (§5.5) ==="
check_true "pnpm store shares a filesystem with ~/workspace" bash -c '
  test "$(stat -c %d "$(pnpm config get store-dir)")" = "$(stat -c %d "$HOME/workspace")"'

echo "=== credential files (§7.3) ==="
check "secrets.env mode 0600"     "600"       stat -c %a "/etc/$FLIT_NAME/secrets.env"
check "secrets.env owned by root" "root:root" stat -c %U:%G "/etc/$FLIT_NAME/secrets.env"
check "storagebox key mode 0600"  "600"       stat -c %a "$HOME/.ssh/storagebox_ed25519"

echo "=== timers (§6.3) ==="
# Looped from lib/jobs.sh, the same committed table 70-timers.sh installs
# from, so a row added there is asserted here without a second edit. The two
# drills get no server timer (§8: drills run from the laptop only) — marked
# in lib/jobs.sh by a laptop-relative command, the same test 70-timers.sh uses
# to skip them.
for spec in "${JOBS[@]}"; do
  IFS='|' read -r name _ _ _ cmd <<<"$spec"
  [[ "$cmd" == ./* ]] && continue
  unit="${FLIT_NAME}-${name}.timer"
  check_true "unit loaded: $unit" bash -c \
    "systemctl list-unit-files '$unit' --no-legend | grep -q ."
  # Drills install timers without enabling them (--no-external-state), so
  # 'enabled' is asserted only outside a drill.
  if [[ $NO_EXTERNAL_STATE -eq 0 ]]; then
    check "unit enabled: $unit" "enabled" systemctl is-enabled "$unit"
  fi
done

# The prune timer is installed by server/lib/50-caches.sh, not by a row in
# lib/jobs.sh, so the loop above never reaches it. It deliberately carries no
# healthchecks check (§5.6): its failure mode is gradual disk growth, which
# the disk-daily check catches.
prune_unit="${FLIT_NAME}-prune.timer"
check_true "unit loaded: $prune_unit" bash -c \
  "systemctl list-unit-files '$prune_unit' --no-legend | grep -q ."
if [[ $NO_EXTERNAL_STATE -eq 0 ]]; then
  check "unit enabled: $prune_unit" "enabled" systemctl is-enabled "$prune_unit"
fi

echo "=== backup escrow (§6.2) — SKIPPABLE ==="
# Needs an unexpired pass-cli token, which expires every 90 days by design.
# 'cannot query' must be distinguished from 'queried and absent': the latter
# means the backups are one disk failure from being undecryptable.
if ! vault_session_ok; then
  skip "backup credentials escrowed" "pass-cli token expired or absent — regenerate; NOT evidence of absence"
else
  for item in restic-password storagebox-key "$FLIT_USER-console-password"; do
    check_true "escrowed in vault: $item" vault_has "$item"
  done
fi

echo "=== git push (§7.2) ==="
# No longer skippable. The box has its own key (laptop/tangled-key.sh), so this
# no longer depends on the operator's forwarded agent being present, which is
# what made it skip in every timer run and drill.
check "tangled key mode 0600" "600" stat -c %a "$HOME/.ssh/tangled_ed25519"
check_true "tangled identifies the box's own key" tangled_identified

# ---------------------------------------------------------------- reporting
echo
echo "PASS=$P FAIL=$F SKIP=$S"
(( ${#FAILED[@]}  )) && printf 'failed: %s\n' "${FAILED[*]}"
(( ${#SKIPPED[@]} )) && printf 'skipped: %s\n' "${SKIPPED[*]}"

# The floor: only the backup-escrow assertion above may skip (§6.2) — the
# Tangled push now runs on the box's own key, not a forwarded agent, so it is
# unconditional like everything else. Skipping more, or evaluating almost
# nothing, means this run proves nothing and must not ping success.
if (( S > 1 )); then
  echo "ABORT: $S assertions skipped, but only 1 is skippable (§5.3)" >&2
  exit 1
fi
if (( P < 11 )); then
  echo "ABORT: only $P assertions evaluated; verify.sh is not doing its job" >&2
  exit 1
fi

exit $(( F > 0 ? 1 : 0 ))