#!/usr/bin/env bash
#
# CRM-only source-backed install/recovery gate.
#
# P1x removed the manufactured two-product neutrality matrix, but the CRM
# install, verify, drift, and runtime-recovery proofs remain production safety
# invariants. This entrypoint keeps those proofs enforced without inventing a
# second installable App.

set -euo pipefail

REPO_ROOT="$(cd "$(dirname "$0")"/../../.. && pwd)"
OUT_DIR="${OUT_DIR:-/tmp/sfmeta/run/crm-source-backed-ci}"

: "${TIDB_HOST:=127.0.0.1}"
: "${TIDB_PORT:=4000}"
: "${TIDB_USER:=root}"
: "${TIDB_PASSWORD:=}"
: "${TIDB_DATABASE:=nexuscrm_crm_source_backed_ci}"
export TIDB_HOST TIDB_PORT TIDB_USER TIDB_PASSWORD TIDB_DATABASE

if [[ -z "${NEXUSCRM_OFFICIAL_APP_PACKS_ROOT:-}" ]]; then
  echo "NEXUSCRM_OFFICIAL_APP_PACKS_ROOT is required for the CRM source-backed gate" >&2
  exit 2
fi
if [[ ! -d "$NEXUSCRM_OFFICIAL_APP_PACKS_ROOT" ]]; then
  echo "NEXUSCRM_OFFICIAL_APP_PACKS_ROOT is not a directory: $NEXUSCRM_OFFICIAL_APP_PACKS_ROOT" >&2
  exit 2
fi

mkdir -p "$OUT_DIR"
source "$REPO_ROOT/tests/integration/l0-completeness/sql-client.sh"
l0_completeness_sql_client
PROBE_FAILURES=0

run_probe() {
  local label="$1"
  shift
  echo "::group::$label"
  set +e
  # Capture the probe result without weakening fail-fast semantics inside a
  # multi-step probe. Shell functions inherit the caller's errexit state, so
  # invoking them directly while set +e can mask an earlier failed step when a
  # later command succeeds.
  (
    set -e
    "$@"
  )
  local rc=$?
  set -e
  echo "$label rc=$rc"
  if [[ "$rc" -ne 0 ]]; then
    PROBE_FAILURES=$((PROBE_FAILURES + 1))
    echo "::error::$label exited non-zero ($rc)"
  fi
  echo "::endgroup::"
}

run_source_backed_runtime_recovery_proof() {
  OUT_DIR="$OUT_DIR" bash "$REPO_ROOT/tests/integration/l0-completeness/controlplane-runtime-recovery.sh"
}

run_release_entrypoint_clean_install() {
  l0_completeness_sql_reset_database
  (
    cd "$REPO_ROOT/backend/distributions"
    # Match the L2 delivery lifecycle exactly. init-l0 exercises a different
    # bootstrap path and cannot prove prerequisites for apply-packs.
    GOWORK=off go run -tags crm ./cmd/setup apply-metadata
    GOWORK=off go run -tags crm ./cmd/setup repair
    GOWORK=off go run -tags crm ./cmd/setup apply-packs
  )
}

run_probe "CRM / release-entrypoint-clean-install" \
  run_release_entrypoint_clean_install

run_probe "CRM / idempotent-and-source-missing" \
  env SETUP_GO_TAGS=crm OUT_DIR="$OUT_DIR" \
  "$REPO_ROOT/tests/integration/l0-completeness/idempotent-and-source-missing.sh" \
  "official_repo:salesforce-crm-standard" "salesforce-crm-standard" \
  "official_repo:gmail-connected-mail-connector"

# The idempotence probe installs the target's declared dependency closure and
# leaves the CRM pack active in its fresh database, so this probe verifies that
# same source-backed installed state.
run_probe "CRM / admin-override-drift" \
  env SETUP_GO_TAGS=crm OUT_DIR="$OUT_DIR" \
  "$REPO_ROOT/tests/integration/l0-completeness/admin-override-drift.sh" \
  "salesforce-crm-standard" "Account" "Name"

run_probe "source-backed runtime recovery proof" \
  run_source_backed_runtime_recovery_proof

if [[ "$PROBE_FAILURES" -ne 0 ]]; then
  echo "::error::$PROBE_FAILURES CRM source-backed probe command(s) exited non-zero" >&2
  exit 1
fi

echo "CRM source-backed evidence: $OUT_DIR"