#!/usr/bin/env bash
set -euo pipefail

image=${1:-nexuscrm-integration-service-ci}
expected_version=${2:-}
expected_revision=${3:-$expected_version}
run_id=${GITHUB_RUN_ID:-local}-$$
container="nexuscrm-integration-service-smoke-$run_id"
logs=$(mktemp)

cleanup() {
  docker rm -f "$container" >/dev/null 2>&1 || true
  rm -f "$logs"
}
trap cleanup EXIT

test "$(docker image inspect --format '{{ index .Config.Labels "dev.nexuscrm.integration.role" }}' "$image")" = integration-service
test "$(docker image inspect --format '{{json .Config.Entrypoint}}' "$image")" = '["/usr/local/bin/integration-service"]'
test "$(docker image inspect --format '{{.Config.User}}' "$image")" = '10001:10001'
if [[ -n "$expected_revision" ]]; then
  test "$(docker image inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$image")" = "$expected_revision"
fi
if [[ -n "$expected_version" ]]; then
  test "$(docker image inspect --format '{{ index .Config.Labels "org.opencontainers.image.version" }}' "$image")" = "$expected_version"
fi

if docker run --name "$container" "$image" >"$logs" 2>&1; then
  echo "integration-service image started without its required serving authority" >&2
  exit 1
fi
grep -Fq 'NEXUSCRM_INTEGRATION_HTTP_ADDR is required' "$logs"
if grep -Fq 'integration service started' "$logs"; then
  echo "integration-service image entered serving without configuration authority" >&2
  exit 1
fi

echo "Integration Service image contract passed"